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Established in 1931, the Institute of Government provides training, advisory, 
and research services to public officials and others interested in the operation 
of state and local government in North Carolina. The Institute and the 
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university’s Master of Public Administration Program are the core activities of 
the School of Government at The University of North Carolina at Chapel Hill. 


Each year approximately 14,000 city, county, and state officials attend one or 
more of the 230 classes, seminars, and conferences offered by the Institute. 
Faculty members annually publish up to fifty books, bulletins, and other 
reference works related to state and local government. Each day that the 
General Assembly is in session, the Institute’s Daily Bulletin, available in 
print and electronically, reports on the day’s activities for members of the 
legislature and others who need to follow the course of legislation. An 
extensive Web site (http://iog.unc.edu/) provides access to publications and 
faculty research, course listings, program and service information, and links 
to other useful sites related to government. 


Support for the Institute’s operations comes from various sources, including 
state appropriations, local government membership dues, private contribu- 
tions, publication sales, and service contracts. For more information about 
the Institute, visit the Web site or call (919) 966-5381. 


t P. Joyce, 
Ann ¢ Simpson, 
ird Whisnant 
DIRECTOR 
Michael R. Smith 


ASSOCIATE DIRECTOR FOR PROGRAMS 
Thomas H. Thornburg 


ASSOCIATE DIRECTOR FOR PLANNING AND OPERATIONS 
Patricia A. Langelier 


uthbertsor 
ASSOCIATE DIRECTOR FOR DEVELOPMENT 
Ann C. Simpson 


FACULTY 


Gregory S. Allison 
Stephen Allred (on leave) 
David N. Ammons 

A. Fleming Bell, II 
Maureen M. Berner 
Frayda S. Bluestein 
Mark F. Botts 

Phillip Boyle 

Joan G. Brannon 

Anita R. Brown-Graham 
William A. Campbell 
Stevens H. Clarke 

Anne S. Davidson 

Anne M. Dellinger 
James C. Drennan 


Richard D. Ducker 

Robert L. Farb 

Joseph S. Ferrell 

Susan Leigh Flinspach 

Kimberly Martin 
Grantham 

Milton S. Heath, Jr. 

Cheryl Daniels Howell 


Joseph E. Hunt 


Kurt J. Jenne (on leave) 
Robert P. Joyce 

Diane Juffras 

David M. Lawrence 
Charles D. Liner 

Ben F. Loeb, Jr. 


Janet Mason 

Laurie L. Mesibov 

Jill D. Moore 

David W. Owens 
William C. Rivenbark 
John Rubin 

John L. Saxon 

Jessica Smith 


John B. Stephens 


A. John Vogt 

Aimee Wall 

W. Jake Wicker 
Richard Whisnant 
Gordon P. Whitaker 





Popular Government 


SPRING 2002 ¢ VOLUME 67, NUMBER 3 


FEATURE ARTICLES 


Privacy and the Law 
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The Fourth Amendment protects people against searches and seizures by 
government authorities, but only if such actions are deemed unreasonable. 
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North Carolina law favors openness in government. To protect people’s 
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Privacy and the Courts 

James C. Drennan 

Tension between privacy and openness often arises in relation to the public’s 
right to observe court proceedings and to look at court records. 
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Stephen Allred 

The Fourth Amendment protects public employees from unreasonable 
searches of their workplaces. How has this standard been applied in 
different contexts? 

Privacy and Public School Students 

Laurie L. Mesibov 


To what extent are students’ privacy interests protected? The U.S. Supreme 
Court has decided to hear three cases involving student privacy issues. 


Health Privacy: The New Federal Framework 

Aimee N. Wall 

In 2001 the first and only comprehensive federal rule on health privacy 
went into effect. A specialist in health law summarizes the rule’s complex 
requirements. 


Privacy and Computer Security: Nine Questions 
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Fundamental to keeping information private are secure computer systems. 
Page 36 How can local governments assess the security of their systems? 
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New Environmental Finance Center 
Focuses on Real-World Issues 


GOVERNMENT 


NC—Chapel Hill’s School of Govern- 
ment, in conjunction with the Kenan 
Center for Private Enterprise, has 

a new research and assistance center 
focusing on the real-world problems of 
environmental finance and management 
The Environmental Finance Center at the 
University of North Carolina, called the 
efc@unc for short, aims to “provide a 
bridge between students and faculty in 
the university who work principally on 
environmental financing, management 
and planning tools and the governments 
and businesses whose job it is to use those 
tools for the public interest,” according to 
its Mission statement 

‘Local governments have a diverse set 
of challenges in the environmental area, 
explains Richard Whisnant, director of the 
center and a faculty member in environ- 
mental law at the School of Government 


“Among them are providing safe drinking 
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ATE AND LOCAL GOVERNMENT 


water, handling and treating wastewater, 
collecting and disposing of solid wastes, 
and minimizing the many adverse effects 
of growth and development 
The common denominator of these 

and all other environmental governance 
challenges, Whisnant says, is that they 
have costs—and finding the financing to 


pay these costs is not always as simple as 
getting a federal grant. “Finance has 
become a critical, sometimes complicated, 
requirement of improved environmental 
management,” ne observes 

Started with a planning grant from the 
U.S. Environmental Protection Agency in 
1998, the efc@unc has blossomed into an 
ongoing center with 
projects in a wide variety of environmental 
areas (see sidebar, opposite). Whisnant and 
Jeff Hughes, associate director and an 
international consultant on environmenta 


research and assistance 


finance (as well as a former utilities director 
n Chatham County), are the principa 
Staff. Other faculty members and students 
work with them on projects 

In addition to its project work, the center 
S developing partnerships with a wide 
range of organizations that provide training 
and assistance to environmental leaders in 
local government. It also has joined eight 
other environmental finance centers at 


universities around the United States to 
create a network of people working on 
environmental finance and management 
problems within academic settings but with 
a mission to help with real-world issues 
Additional information is available at 
the center's Web site, www.efc.unc.edu 
To learn more about the center's work or 
to offer suggestions for projects or 
research that should be undertaken, 
contact Whisnant at (919) 962-9320 or 
richard_whisnant@unc.edu, or Hughes at 
(919) 843-4956 or jhughes@unc.edu 





efc@unc projects 
During 2001 the efc@unc 


published a major report on the 
costs and financing of North 
Carolina’s Million Acres land- 
conservation initiative; 


Consortium Builds Bridges 
Between Government and Youth 


he North Carolina Civic Education 

Consortium, a program of the 

Institute of Government, has 
received major grants for several initiatives 
to help local governments involve young 
people in issues and programs that 
concern them and their communities 


e A pilot project funded by the Golden 
LEAF Foundation will develop youth 


e A Small Grants Program funded by the 
Z. Smith Reynolds Foundation will provide 
$1,000 to $10,000 to outstanding youth 
involvement programs. The consortium 
encourages local governments, including 
school boards, to apply for these grants 
Applications for 2002 grants will be 
available from the consortium office by 
July 1, 2002. Recipients will be selected 


began work with several other leadership programs in two rural coun- by December 1, 2008 
environmental finance centers on 
a national pilot project on source- 
water protection, which is based in 


Rutherford County; and 


ties, Bertie and Swain. Initially the con- The consortium also has received a 
substantial two-year grant from the 


sortium will organize mode! youth 
Carnegie Corporation of New York to 


councils linked to local governments and 
ennance its organizational capacity 
including fund development and stra- 


create cross-generational teams to ex- 
plore the economic development chal- 
lenges facing these counties. In the 


delivered a comprehensive 
environmental finance curriculum 
to the U.S. Environmental 
Protection Agency and other 
environmental finance centers 
around the country 


For 2002 the efc@unc has been 
awarded a grant to develop inno- 
vative distance-education modules 
on environmental finance topics for 
engineering master’s degree students 
and local government environmental 
professionals who have had little 
opportunity for practical environ- 
mental finance training. This project 
is the start of long-term efforts that 
are central to the strategic plan of 
the efc@unc: to use information 
technology as a bridge between 
environmental finance expertise and 
government officials (and their 
consultants and contractors) who 
most directly need that expertise. 

Another of the center's efforts in 
this regard is a database of state- 
based environmental financing sources 
in the Southeast. The database will 
include grant and loan sources that 
are funded by state or local govern- 
ments or other entities that operate 
primarily within a state or a similar 
limited geographical area. 


tegic planning. By improving its internal 
practices, the consortium will 
increase its ability to support 
and expand its most successful 
programs 


Research shows that giving 
young people a chance to par- 
ticipate in government decision 
making is the most effective 
form of civic education, 
according to consortium 
director Debra Henzey. “It fos 

ters lifelong civic interest and involvement 
The consortium’s work builds on a 

tradition going back to the 1940s, when 

Institute of Government founder Albert 


second phase of the project, the consor- 
tium will help other rural communities 
replicate the most successful elements of 
the pilot program 

Already the grant has allowed Bertie 


Coates involved the Institute in civic 
education classes for teachers and young 
people. The original efforts died out 
during World War II, but local government 
officials asked the Institute to restore this 
part of its mission during a long-term 
planning process in the mid-1990s 
Government leaders were increasingly 
concerned that the quality of public 
debate on important issues had declined 
and that fewer people in communities 
were willing or prepared to assume 
leadership roles 

The consortium was founded in 1997 
with support from the Z. Smith Reynolds 
Foundation. Enlisting as a partner is free 
For more information on the consortium’s 
programs or to send information about 
local government youth programs, contact 
Henzey at (919) 962-8273 or henzey@ 
iogmail.iog.unc.edu 


County to hire a youth coordinator to 
develop a youth council and build a net- 
work of programs that serve or involve 


young people 


With a grant channeled through Provi- 
dence College (in Rhode Island) from 
funds from the Pew Charitable Trusts, 
the consortium will develop a network of 
twenty-four high schools across the 
state, then work with a team of students 
at each school to inventory civic involve- 
ment opportunities. The teams will lead 
focus groups of parents, students, 
teachers, and others to identify these 
opportunities and to select at least one 
strategy for their high school to use to 
improve youth civic involvement. Local 
governments and school boards will be 
partners in this effort 
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Teleconference Provides Timely, 
Economical Look at Changes in Law 
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New Scholarships 
Available for 
Institute Classes 


he Local Government Federal 

Credit Union (LGFCU) is offering 

its members the opportunity to 
apply for scholarships that will cover 
tuition for Institute of Government 
classes, conferences, and seminars 
Scholarships will be awarded quarterly. 
Application deadlines are March 15, 
June 15, September 15, and Decem- 
ber 15. Funds are limited, so appli- 
cations should be sent in as early as 
possible each quarter. 

For more information and an 
application form, call (800) 344-4846 
or e-mail Info@LGFCU.org. LGFCU 
plans to put information about the 
scholarship program on its Web site 
(www.LGFCU.org) in the near future. 





MPA Students Present Results of 
Practical Research 
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Listservs Connect Local Governments 
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Listservs collect multiple 
e-mail addresses under a single 
e-mail address and allow 
members to send a message to 
everyone on the list u 
single address—for example, 
listservname@listserv.unc.edu 
To join a list or to get more 

information about how listservs 
work, contact Young at (919) 
962-0592 or pyoung@imap 
unc.edu 
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John Stephens 
Robert Farb 
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Human Resources and Personnel 
Facilitation and Organizational Development Group 
Recent North Carolina Criminal Court Decisions 


News of Institute of Government 
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Finance Officers and Directors 
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After Dale Earnhardt’s fatal 
car crash during the Daytona 
500 on February 18, 2001, 

his widow argued that public 
disclosure of the medical 
examiner's autopsy photo- 
graphs would violate the 
family’s right to privacy. The 
Florida legislature responded 
by amending the state's 
public records law to bar the 
release of autopsy records 
without a court order. 
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In January 2001, surveillance 
cameras photographed 
100,000 spectators as they 
passed through the turnstiles 
at the Super Bowl in Tampa, 
Florida. A biometric face- 
recognition system then 
matched the photographs 
against a database of con- 
victed criminals maintained 
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by the FBI and state and local Pe 


police. Critics arqued that the 
system violated individual 
privacy. Advocates responded 
that it was no more intrusive 
than the routine video 
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surveillance that most people * 


* encounter every day in banks, 


stores, malls, and office 
buildings, at ATM machines, 
and on public streets. 
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Privacy and the Law 


John L. Saxon 


ore than 80 percent of 

Americans say that they 

are concerned about 
the loss of their personal privacy— 


especially about the collection, use, 

and disclosure of personal, financial, 
and medical information by government 
agencies, insurance companies, banks, 
employers, medical providers, on-line 
businesses, and private data-collection 
agencies. ! 

The exponential growth of informa- 
tion technology—computerized systems 
of data collection, storage, and retrieval, 
electronic surveillance devices, and so 
forth—during the past thirty years has 
contributed to public concern about 
privacy by making it easier and easier 
for government agencies, businesses, 
and individuals to gather and exchange 
information. 

Concern about privacy is not new, 
however. More than one hundred years 
ago, responding to what they viewed as 
the unprecedented invasion of the 
“sacred precincts of private . . . life,” 
Samuel Warren and Louis Brandeis 
asserted in the Harvard Law Review 
that the law should protect the “privacy 
of private life” by recognizing indiv- 
iduals’ rights to prevent others’ access 
to, use of, and public disclosure of their 
personal writings, thoughts, feelings, 
likeness, or private acts.’ In the 1960s 
many people, including Justice William O. 
Douglas, believed that government 
surveillance constituted the primary 
threat to privacy.* Today many people 
think that the private sector threatens 
privacy as much as, or more than, 
government does.° 
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What Is Privacy? 


Although privacy is clearly an important 
legal and social concept, only recently 
have there been any serious efforts to 
analyze what “privacy” means.° In one 
sense, privacy is a nonlegal concept, with 
psychological, social, and political dimen- 
sions, that describes the boundaries 
between an individual and other people, 
society, and government—between 
matters, beliefs, communications, and 
activities that are personal or private in 
nature and those that are social in nature 
or of public concern.’ Privacy also is a 


- 


legal concept, consisting of moral rules, 
social norms, and legal rights that 
recognize, protect, and sometimes limit 
individuals’ expectations and claims. 

In 1880, Judge Thomas Cooley 
offered one of the first definitions of the 
right to privacy: the right “to be let 
alone.”* Cooley’s definition was subse- 
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The author is an Institute of Government 
faculty member who specializes in social 
services, elder law, and child support 
issues. Contact him at saxon@iogmail.iog. 


unc.edu. 





quently adopted and made famous as 
“the right most valued by civilized 
men” by Justice Brandeis in his 1928 
dissent in Olmstead v. United States.’ 
More recently, privacy has been 


defined as 


e the right to control others’ access to, 
use of, and disclosure of information 
about oneself; 

e the right to be free from unjustified 
public scrutiny; and 

e the right to be free from unreason- 
able intrusions on one’s solitude and 


repe se. 


In addition, privacy today is 
generally understood to include both 


e the right to be free from unwar- 
ranted surveillance or searches of 
one’s home, person, or communi- 
cations by government agencies, and 

e the right to be free from governmen- 
tal control, re gulation, or coercion 
with respect to personal decisions or 
matters that lie at the core of 
individual autonomy (such as 
sexuality, birth control, abortion, 
family relationships, and personal 


beliefs). 


No single definition of privacy, how- 
ever, is wholly satisfactory or complete.' 
Instead, “privacy” appears to be an 
umbrella term that encompasses a wide 


variety of interests, claims, and rights.! 


Why Does the Law 
Protect Privacy? 


Every person has some degree of 
personal privacy regardless of whether 
the law recognizes and protects it. An 
individual, however, has a legal right to 
privacy only to the extent that the law 
(1) recognizes as legitimate that 
individual’s interest, expectation, or 
claim to privacy; (2) imposes a corres- 
ponding duty on others not to invade or 
interfere with the individual’s privacy; 
and (3) protects his or her right to 
privacy against others. ' 

But why should the law protect 
individual privacy? What individual and 
social interests does privacy sery e? 

Every individual has an interest in 
personal privacy, solitude, and auton- 
omy. Simply put, some matters are 


“nobody else’s business.” '* Sociologist 
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Amitai Etzioni argues that privacy is a 
veil behind which one may shield what 
is legitimately private from public view." 
(Richard Posner offers a contrary view, 
which may not be widely shared: that 
privacy facilitates fraud and misrepre- 
sentation by allowing people to conceal 
true but embarrassing information about 
themselves from others in order to gain 
unfair social or economic advantage.)'® 
Psychologically and socially, people 
need a certain degree of privacy and 
solitude—“a refuge within which [they] 
can shape and carry on [their] lives. . . 
without the threat of scrutiny, embarrass- 
ment, judgment, and the deleterious 
consequences they might bring.” !” 
Privacy protects individual autonomy; 
safeguards people from tangible social 
or economic harm or discrimination 
resulting from the disclosure of sensi- 
tive, embarrassing, or negative infor- 
mation;'* and allows people to establish 
and maintain important personal, 
social, and professional relationships. 
Privacy is more than an individual 
value, however; it 
also is a social one. 


Privacy is 


important not 
only because of its 
protection of the 
individual as an 
individual but also 
because individ- 
uals share com- 
mon perceptions 
about the impor- 
tance and meaning 
of privacy, because 
it serves as a 
restraint on how 
organizations use 
their power, and 
because privacy— 
or lack of privacy 
— is built into sys- 
tems and organi- 
zational practices 
and procedures... 
[thereby giving] 
privacy broader 
social, not only 
individual, signifi- 


cance. 


Moreover, in at least 
some instances, 


Privacy protects individual 
autonomy; safeguards 
people from tangible 
social or economic harm 
or discrimination resulting 
from the disclosure of 
sensitive, embarrassing, or 
negative information; and 
allows people to establish 

| and maintain important 
personal, social, and 
professional relationships. 


privacy serves public or social purposes 
that are unrelated to, or go beyond, the 
protection of individuals’ interests. For 
example, federal rules regarding the 
confidentiality of treatment records for 
alcohol and drug abuse protect patients 
from stigma or harm they might suffer 
as a result of public disclosure of their 
status. But the rules also serve an 
important public and social purpose: 
minimizing the social impact of alcohol 
and drug use by encouraging patients to 
seek treatment without fear of public 
scrutiny and by protecting the confi- 
dential relationship between patients 
and professionals that is required for 
successful treatment.?! 


Is Privacy Absolute? 


Is privacy absolute? The short answer 
is no. 

The reason is threefold. First, 
absolute privacy is simply impossible in 
society. The very act of engaging in per- 
sonal relationships with others and 
living in society necessarily requires an 
individual to relinquish 
his or her personal pri- 
vacy to some extent.~ 

Second, legal rights 
to privacy are more 
limited in scope than 
the concept of privacy 
itself. Privacy encom- 
passes a broad range 
of individual and 
social interests, and 
not every invasion or 
loss of privacy 1s of 
sufficient importance 
or weight to warrant 
legal protection. 

Third, and most 
important, although 
privacy is an important 
individual and social 
value, it is not the only 
value that the law and 
public policy must take 
into consideration.*4 
Individual and social 
interests in privacy 
often must be balanced 
against competing in- 
dividual and social 
interests, such as gov- 
ernmental account- 





ability, public safety, and administrative 
efficiency.?> In some instances the com- 
peting interests may either limit or com- 
pletely override individual and social 
interests in privacy. For instance, virtually 
every statute or legal rule recognizing an 
individual’s legal right to privacy in the 
information gathered about him or her 
includes one or more exceptions under 
which otherwise private, privileged, or 
confidential information may or must 
be disclosed to someone in some cir- 
cumstances for some purpose.” 

The real issue, of course, is how 
much weight to give privacy versus 
other interests in any particular situa- 
tion. Some privacy advocates contend 
that a presumption of privacy should be 
the “default setting of the Information 
Age.”2’ By contrast, sociologist Amitai 
Etzioni argues that privacy should not 


be accorded special status. Instead, it 
should be treated like any other 
individual right that must be balanced 
with concerns for the common good.”* 


What Rights to Privacy Does 
the Law Protect? 


It is generally agreed that the law 
recognizes and protects four distinct 


rights to privacy: 


e¢ Freedom from unreasonable searches 
by government agencies or officials 
Individual autonomy—the right to 
make personal decisions about 
sexuality, birth control, abortion, 
and family relationships free from 
governmental control or coercion 
Freedom from unwarranted 
intrusions on personal solitude 
or seclusion 


e “Informational privacy,” protecting 
individuals from unreasonable 
collection, use, and disclosure of 


personal information 


Each of these rights depends on dozens 
(if not hundreds) of laws—federal and 
state constitutional provisions, federal 
and state statutes and regulations, court 
decisions, and the common law.’ Those 
laws determine what privacy means in 
particular situations: whether an indi- 
vidual has a legal right to privacy, what 
the nature and the scope of that right are, 
and how that right will be protected.*” 


Constitutional Rights 
Although the U.S. Constitution does not 
expressly refer to a right to privacy, it 
clearly protects at least three aspects of 
individual privacy. First, the Fourth 
Amendment’s prohibition against 
unreasonable searches limits govern- 
ment surveillance that unduly intrudes 
on an individual’s home, person, or 
communications.*! (For a detailed dis- 
cussion of the Fourth Amendment’s 
guarantees, see the article on page 13.) 
Second, the Supreme Court has 
recognized a constitutional right of 
privacy that protects individual liberty 
and autonomy by limiting government 
interference with or control of personal 
decisions regarding birth control, abor- 
tion, marriage, parenting, and family.* 
Third, the Supreme Court’s 1977 
decision in Whalen v. Roe suggested 
that the Constitution’s protection of 
individual privacy encompasses a right 
to “informational privacy,” which may 
limit the authority of federal, state, and 
local governments to obtain, use, or 
disclose personal information about 
individuals. The Whalen case involved a 
New York law that required doctors to 
send a copy of all prescriptions for certain 
legal but dangerous drugs to the state 
health agency, which maintained a com- 
puterized database including the name, 
the address, and the age of the patients 
for whom the drugs were prescribed. 
The Court recognized that “the accumu- 
lation of vast amounts of personal infor- 
mation in computerized data banks or 
other massive government files” threatens 
individual privacy.** However, the Court 
also recognized that the government’s 
collection and use of personal informa- 
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Several municipalities 


in North Carolina are 


authorized to mount cameras 
at intersections to photograph 
drivers running red lights. 


tion is necessary in order to collect 
taxes, enforce criminal laws, protect the 
public health, and administer govern- 
ment programs, and that its right to 
collect personal information generally 
is accompanied by a corresponding 
legal duty to avoid unwarranted dis- 
closure or use of that information. 

Further, the Whalen decision recog- 
nized, at least implicitly, that the Constitu- 
tion establishes a floor for the protection 
of individual privacy, including a right 
in some circumstances not to have one’s 
private affairs made public by the gov- 
ernment. However, the Court held that 
New York did not violate the constitu- 
tional privacy rights of patients because 
the state’s collection of prescription 
records from pharmacists was reasonably 
related to its legitimate interest in con- 
trolling the distribution of dangerous 
drugs and minimizing their misuse, and 
the law adequately protected the patients’ 
confidentiality by limiting access to, use 
of, and disclosure of the information. 

Although the North Carolina 
Constitution does not expressly recog 
nize a right to informational privacy, 
both the North Carolina Supreme 
Court and the North Carolina Court of 
Appeals have held that the state consti- 
tution nonetheless includes a right to 
privacy that is similar to the constitu- 
tional right to informational privacy 
recognized in Whalen. 


Federal Laws and Regulations 

The federal Privacy Act limits, but does 
not completely prohibit, the disclosure 
of personal information from most 
record systems maintained by federal 
agencies without the written consent of 
the individual to whom the record 
pertains. The act generally does not 
apply to state or local government 
agencies—even if those agencies receive 
federal funding. * 

Che federal Freedom of Information 
Act (FolA) requires most federal agencies 
to make information in their records 
available to the public. But it also allows 


federal agencies to refuse to release 
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information or records if (1) disclosure 
would constitute a clearly unwarranted 


invasion of privacy or (2) the records are 


considered confidential or protected 
from disclosure under a federal statute 
(other than the Privacy Act).*” The FolA 
applies only to federal agencies; it does 
not apply to state or local governments. 

A number of federal laws impose 
privacy requirements on state and local 
governments as a condition of receiving 
federal funding. The federal Family 
Educational Rights and Privacy Act 
(FERPA), for example, prohibits the 
U.S. Department of Education from 
providing federal funding to educational 
institutions whose policies or practices 
regarding the release of personally 
identifiable information contained in 
student education records do not 
comply with FERPA’s confidentiality 
requirements. ”° 


‘ 


st 


ee 


Other federal laws impose confiden- 


tiality requirements that are not tied to 
federal funding. For example, the 
federal Computer Matching and Privacy 
Protection Act of 1988 restricts the use 
and redisclosure of personal informa- 
tion that state and local social services 
agencies receive from federal record 
systems for use in computerized data- 
matching programs.*’ Similarly, one 
provision of the federal Privacy Act 
limits, but does not completely negate, 
the authority of state and local 
governments to require individuals to 
disclose their Social Security numbers in 
connection with their exercise of any 
right, benefit, or privilege provided by 
law.* The federal Videotape Privacy 
Protection Act prohibits businesses that 
are engaged in the rental or sale of 
videotaped movies from disclosing 
information that personally identifies 
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the specific videotaped materials rented 
or bought by consumers unless the 
disclosure is allowed under the act.*! 
And the federal regulations on medical 
privacy adopted pursuant to the Health 
Insurance Portability and Accounta- 
bility Act (discussed further in the 
article that begins on page 44) apply to 
virtually all health care providers and 
health care plans.* 


State Statutes 

North Carolina’s General Assembly has 
enacted a number of statutes restricting 
the collection, use, or disclosure of 
personal information by state and local 
governments. For example, the state’s 
Financial Privacy Act limits, but does 
not completely preclude, access by state 
and local government agencies to cus- 
tomers’ financial records maintained 

by banks and other financial institu- 
tions.*’ Further, state statutes limit the 
disclosure by state and local government 
agencies of information from agency 
records regarding individual taxpayers, 
children involved in juvenile court 
proceedings, people who apply for or 
receive public assistance or services 
from county social services agencies, and 
public employees. 

North Carolina law also protects 
privacy by limiting disclosure of certain 
types of personal information collected 
by businesses, professionals, or indi- 
viduals. For example, state rules govern- 
ing the licensing of attorneys, doctors, 
psychologists, and other professionals 
often impose restrictions regarding the 
disclosure of confidential information 
about clients or patients.** Further, state 
statutes provide that “privileged” com- 


munications between clients, patients, 
or other specified types of individuals, 
and doctors, psychologists, clergy, or 
other specified categories of people 
generally may not be admitted as 
evidence in legal proceedings.*° Other 
state laws restrict the disclosure of 
patients’ prescription records by 
pharmacists, the disclosure of patients’ 
records by public or private mental 
health facilities, the disclosure by any 
person that another person has HIV or 
AIDS, and the disclosure of library 
users’ records by public libraries and 
private libraries that are open to the 
public.*’ In at least one instance, state 
law recognizes and protects a right to 
privacy with respect to personal solitude 
and repose by limiting the time and the 
manner of telephone solicitation calls.** 
On the other hand, some state statutes 
limit privacy by requiring the release of 
information to state or local government 
agencies even if the information might 
otherwise be considered confidential. 
For example, state law generally requires 
individuals, businesses, professionals, 
and government agencies to share infor- 
mation with county social services agen- 
cies in cases involving child abuse and 
neglect or child support enforcement.* 


Common Law 

Courts in other states have recognized 
four distinct common law rights to 
privacy that protect individuals against 


unreasonable public disclosure of 
their private information; 
unreasonable intrusion on their 
solitude or seclusion or into their 
private affairs; 


Many Web sites use encryption 
software to protect the information 
that passes across the Internet. 


© misappropriation of their likenesses 
or identities; and 
being placed in a false light before 
the public. 


North Carolina’s courts have recog- 
nized a common law right to privacy for 
claims based on the misappropriation of 
an individual’s name or likeness and on 
intrusion on solitude or seclusion.’ But 
they have refused to recognize common 
law privacy claims based on placing an 
individual in a false light or claims 
involving the public disclosure of pri- 
vate information.*! On the other hand, 
North Carolina law recognizes legal 
claims based on the improper disclosure 
by attorneys, doctors, or other profes- 
sionals of confidential information 
regarding their clients or patients, as 
well as claims based on a person’s (or, 
perhaps, a government employee’s or 
agency’s) intentional or negligent inflic- 
tion of emotional distress by unreason- 
ably disclosing personal information 
about an individual. 


Summary 


Privacy is clearly an important public 
issue and a primary value of an open 
society—a value that has been recog- 
nized, protected, and sometimes limited 
by law. Privacy also is a multifaceted 
concept, sometimes confusing and 
complicated and not always clearly 
understood. 

This article has provided a brief 
overview of the meaning of privacy, the 
individual and social interests that 
privacy serves, the competing public 
interests that may limit individual 
privacy, and the nature and the sources 
of legal rights to privacy. Other articles 
in this issue examine in more detail how 
privacy laws may affect state and local 
government agencies and officials. 
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The Fourth Amendment, 
Privacy, and Law Enforcement 


Robert L. Farb 


North Carolina appellate courts 
have upheld the constitutionality 
of checkpoints for driver’s licenses. 


The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches 


and seizures, shall not be violated, and no Warrants shall issue but upon probable cause, supported by Oath or 


affirmation and particularly describing the place to be searched and the persons or things to be seized. 


rivacy ... the right to be free from 
governmental interference... a 
law enforcement officer’s authority 
to investigate crimes . . . the government's 
interest in investigating conduct that is 
not necessarily criminal—the Fourth 
Amendment affects all these issues. ' 

The Fourth Amendment protects 
people against unreasonable searches 
and seizures by government authorities. 
The U.S. Supreme Court, which must 
determine how the Fourth Amendment 
applies in a wide range of contexts, has 
sought to strike a balance between 
society’s interest in investigating crime 
and individuals’ interests in maintaining 
their privacy against government intru- 
sion. The Fourth Amendment does not 
apply to activities by a private person, 
no matter how unjustified, unless the 
private person acts as an agent of govern- 
ment officials or acts with their 
participation or knowledge. 

One U.S. Supreme Court case, Katz 
v. United States, has had a particularly 
important impact on the relationship 


between privacy and government 
authority under the Fourth Amendment, 
establishing the basic test for deter- 
mining whether a person’s interest in 
privacy is sufficient to warrant Fourth 
Amendment protection.” This and later 
cases decided by the Court—as well as 
federal and state legislation that expands 
on the basic protections afforded by the 
Fourth Amendment—are the focus of 
this article. 


Reasonable Expectation of 
Privacy under the 
Fourth Amendment 


Charles Katz’s occupation was illegal 
gambling. In February 1965 he was 
using several telephones in a bank of 
public telephone booths on Sunset 
Boulevard in Los Angeles to conduct his 
gambling business. The Federal Bureau 
of Investigation (FBI) learned of his 
activities and placed microphones and a 
tape recorder on the tops of the telephone 
booths and recorded his conversations— 


—U.S. Constitution, Amendment IV 


without obtaining a search warrant. He 
was convicted of gambling violations. 

The appeal of his conviction 
eventually reached the U.S. Supreme 
Court. The government argued that no 
search occurred because the FBI had not 
physically penetrated the telephone 
booth to listen to Katz’s conversations.‘ 
The Court’s opinion, written by Justice 
Potter Stewart, rejected the govern- 
ment’s argument. It said that the Fourth 
Amendment protects people, not places. 
What a person knowingly exposes to 
the public, even in his or her own home 
or office, is not protected by the Fourth 
Amendment. But what a person seeks 
to preserve as private, even in an area 
accessible to the public, may be constitu- 
tionally protected. The Court concluded 
that the government’s activities in 
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electronically listening to and recording 
Katz’s conversations violated the privacy 
on which he justifiably relied while using 
the telephone booth, and thus violated 
the Fourth Amendment. 

\t least as significant as Justice Stew- 
urt’s opinion was Justice John Harlan’s 
concurring opinion, which used the term 
“reasonable expectation of privacy ” and 
explained its meaning. Justice Harlan 
noted that the Court had ruled that an 
enclosed telephone booth is an area, like 
a home, where a person has a constitu- 
tionally protected reasonable expectation 
of privacy. He said that there is a two- 
fold requirement when determining if 
there is Fourth Amendment protection: 
(1) a person must have demonstrated an 
actual (subjective) expectation of 
privacy; and (2) the expectation must be 
one that society is prepared to recognize 
as reasonable. A person who enters a 
telephone booth, shuts the door, and 
places a call, Justice Harlan continued, 
is entitled to assume that his or her 
conversation Is not being intercepted— 
per the first test just stated. And al- 
though an enclosed telephone booth is 
accessible to the public at times, its 
occupant’s expectation of freedom from 
intrusion when inside the booth is one 
that society recognizes as reasonable— 
per the second test. Later Supreme Court 
cases have adopted the reasonable- 
expectation-of-privacy analysis for 
determining whether people’s activities 
are protected from governmental intru- 


sion under the Fourth Amendment. 


Government Actions Subject 
to the Fourth Amendment 


The Katz test provides a starting point 
for determining the extent of the Fourth 
Amendment’s protections: the amend- 
ment applies when a person has a reason- 
able expectation of privacy. Other court 
decisions have developed rules detailing 
how the Fourth Amendment regulates 
government conduct in specific situa- 
tions. Those rules are the subject of this 


section. 


Street Encounters 

Little did Detective Martin McFadden 
know when he was patrolling down- 
town Cleveland, Ohio, on the afternoon 
of October 31, 1963, that his encounter 
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with John Terry would lead to the U.S. 
Supreme Court’s most significant ruling 
expanding a law enforcement officer’s 
authority to investigate criminal activity. 

Detective McFadden, a police officer 
for thirty-nine years and a detective 
for thirty-five years, had been patrolling 
downtown Cleveland for shoplifters 
and pickpockets for thirty years. His at- 
tention was drawn to two men, Richard 
Chilton and John Terry, standing at an 
intersection. He later testified that “they 
didn’t look right to me at the time.”' 
McFadden decided to observe them 
from a distance of 300 to 400 feet. The 
two men took turns walking past store 
windows and looking into a particular 
one. Then they conferred briefly. They 
repeated this ritual five or six times 
apiece—in all, making about a dozen 
trips. A third man approached them, 
engaged them briefly in conversation, 
then walked away. Chilton and Terry 
resumed their measured pacing, peering, 
and conferring. After about ten minutes, 
they walked off together in the same 
direction as the third man. 

McFadden now had become sus- 
picious that they were casing a store to 
commit a robbery. He feared that they 
might have a gun. He followed the two 
men and saw them stop in front of the 
store to talk to the same man with 
whom they had conferred earlier. 
McFadden approached them, identified 
himself as a police officer (he was in 
plain clothes), and asked for their names. 
When the men mumbled something in 
response to his inquiries, McFadden 
grabbed Terry—spun him around so 
that he and McFadden were facing the 
other two—and patted down the out- 
side of his clothing. He felt a pistol in 
the left breast pocket of Terry’s overcoat, 
which he removed after securing all 
three men. Terry was convicted of car- 
rying a concealed weapon. The appeal 
of his conviction eventually reached the 
U.S. Supreme Court. 

Chief Justice Earl Warren wrote the 
Court’s opinion in Terry v. Ohio, which 


decided several significant issues: 


e Stopping and frisking are subject to 
the Fourth Amendment even though 
those actions may not be as intrusive 
as an arrest or a full search of a 
person. The Court found that in 


forcibly stopping Terry by grabbing 
him, Detective McFadden seized 
him, and that in patting down the 
outer surfaces of Terry’s clothing, 
McFadden searched him. The Court 
recognized that both the seizure (the 
forcible stop) and the search (the 
frisk) were actions regulated by the 
Fourth Amendment. 


The Court noted that if this case 
involved law enforcement conduct 
subject to the Warrant Clause 

(“no Warrants shall issue but upon 
.”) of the Fourth 
Amendment, then the Court would 


probable cause . . 


have to determine whether probable 
cause existed to justify McFadden’s 
search and seizure of Terry. To 
determine whether probable cause 
was the appropriate standard, the 
court used a balancing test: evalu- 
ating the officer’s need to search or 
seize against the invasion of privacy 
that the search or seizure entailed.* 
The Court decided that officer safety 
outweighed the intrusion on a 
person’s freedom when frisked for 
weapons, and a standard less than 
probable cause was reasonable under 
the Fourth Amendment’s general 
proscription of unreasonable searches 
and seizures. This standard became 
known in later cases as “reasonable 


suspicion. ”° 


The Court determined that, in light 
of McFadden’s experience as a law 
enforcement officer, the information 
he possessed supported his frisk of 
Terry for weapons. Also, the Court 
ruled, the scope of the frisk—patting 
Terry’s outer clothing—was properly 
confined to what was necessary to 
learn whether he was armed. That is, 
McFadden did not conduct an 
impermissible general exploratory 
search for evidence of criminal 
activity. 


As he had done in Katz v. United 
States, Justice Harlan wrote a significant 
concurring opinion. The Court’s opinion 
did not specifically address whether the 
forcible stop of McFadden was lawful. 
Justice Harlan made clear his view, 
however, that an officer may forcibly 
stop a person before frisking him or her 
for weapons, and the standard for that 
stop also is less than probable cause. 





Che Court in later cases recognized that 
an officer may make a forcible stop of a 
person or a vehicle on the basis of rea 


sonable suspicion of criminal activity. 


The Home and Its Curtilage 
lhe U.S. Supreme Court has stated that 
the “physical entry of the home is the 
chief evil against which the wording of 
the Fourth Amendment is directed” and 
that “searches and seizures inside a home 
without a warrant are presumptively 
unreasonable.”!! Thus a law enforcement 
officer may not enter a home without a 
warrant unless (1) the officer has con- 
sent to enter or (2) exigent circumstances 
(a need for immediate action) justify 
entering without consent or a warrant. 
Entering a residence to arrest. Without 
consent or exigent circumstances, an 
officer needs an arrest warrant to enter 
the residence of a person to be arrested. 
Without consent or exigent circum- 
stances, an officer who wants to enter 
the home of a third party to arrest a 
person who does not live there must 
have a search warrant. An arrest war- 
rant is insufficient to enter a third 


party’s home because it does not ade- 


quately protect the third party’s Fourth 


Amendment privacy interests. 

Entering the curtilage. People have a 
reasonable expectation of privacy not 
only in their home but also in its curti- 
lage.'? The “curtilage” is the area imme- 


diately surrounding the home, so 
intimately tied to the home itself that it 
deserves Fourth Amendment protection 
—for example, the area that includes 
buildings like an unattached garage, a 
storage shed, and similar structures, if 
they are relatively close to the dwelling 
and serve the homeowner’s daily needs. 

Officers who enter the curtilage 
without a warrant, consent, or exigent 
circumstances conduct an impermissible 
search under the Fourth Amendment 
except when they go to a house by using 
the common entranceway (for example, 
a driveway or a sidewalk leading to a 
door) for a legitimate purpose, such as to 
question a suspect in a criminal investi- 
gation. A person ordinarily expects a 
variety of people to enter private prop- 
erty for any number of reasons. There- 
fore a person does not have a reasonable 
expectation of privacy in the areas of 
private property commonly used by 
those who come there. '* 

Entering areas outside the curtilage. 
When officers are on private property 
outside the curtilage—for example, 
when they are walking through fields or 
woods—they are not conducting a 
search under the Fourth Amendment 
because the U.S. Supreme Court has 
ruled that a person has no reasonable 
expectation of privacy in the area out- 
side the curtilage.'’ The Fourth Amend- 
ment does not protect that area even if 


When officers 
have lawfully 
stopped a 
vehicle, they 
may order both 
the driver and 
passengers out 
of it. To frisk 
an occupant, 
they need at 
least reasonable 
suspicion that 
the person is 
armed and 
presents 

a danger. 


officers are committing a criminal 
trespass or even if the area is surrounded 
by a fence with no-trespassing signs." 
However, a person may have a reason- 
able expectation of privacy in an 
enclosed building located there.' 

Using devices to detect activity within 
ahome. Officers suspected that 
marijuana was being grown in Danny 
Kyllo’s home. Growing marijuana 
indoors typically requires high-intensity 
lamps. Officers parked their car on the 
street near his home and—without 
obtaining a search warrant—used a 
thermal imager to determine whether 
the amount of heat emanating from the 
home was consistent with the use of 
such lamps. The imager showed that the 
roof over the garage and a side wall of 
the home were relatively hot compared 
with the rest of the home and substan- 
tially warmer than neighboring homes. 
On the basis of this and other informa- 
tion, the officers obtained a search 
warrant. In Kyllo v. United States, the 
U.S. Supreme Court ruled that using 
sense-enhancing technology to obtain 
any information concerning the interior 
of a home (in this case, the relative heat 
of various rooms) that could not have 
been obtained without physical intrusion 
into a constitutionally protected area is 
a search under the Fourth Amendment 
—at least when the technology is not in 
general public use.'* Thus the officers in 





this case violated Kyllo’s Fourth 
Amendment rights by using a thermal 
imager without first having obtained a 
search warrant. 

The Kyllo ruling makes clear that the 
Court will likely consider to be a search 
the use of other technological instruments 
as intrusive as a thermal imager to reveal 
private matters within a home. It remains 
unclear whether the Court will rule 
differently if and when certain techno- 
logical instruments become widely used 
by the general public. 

Flying over a home and its curtilage. 
Generally, aircraft surveillance is per 
missible to help officers make observa- 
tions and does not constitute a search 
under the Fourth Amendment. For 
example, officers do not conduct a 
search when they fly in lawful navigable 
airspace over a home and its curtilage 
and see with their unaided eyes marijuana 
plants in a fenced-in yard. The U.S. 
Supreme Court has ruled that a person 
does not have a reasonable expectation 
of privacy from observations from an 
aircraft in public airspace at an altitude 
at which the public travels with suf 
ficient regularity—because any person 
flying in such airspace who looks down 
can see what officers can see.2! However, 
officers’ actions may constitute a search, 
requiring appropriate justification— 
usually a search warrant—if they also 
use sophisticated cameras and the like 
to see intimate activities within a home 
or its curtilage that they could not see 
unaided. 

Officers may fly aircraft at any 
altitude over open fields because, as 
with areas outside the curtilage of his or 
her home, a person does not have a 
reasonable expectation of privacy there. 

Sorting through garbage. The U.S. 
Supreme Court has ruled that people do 
not have a reasonable expectation of 
privacy in garbage that they have placed 
for collection on the curb in front of 
their house.*? The Court reasoned that 
garbage left on or at the side of a public 
street is readily accessible to scavengers 
and other members of the public. More- 
over, people are aware when placing 
their trash for pickup by a third party— 
for example, sanitation workers—that 
these workers may sort through the 
garbage or permit others, including law 


enforcement officers, to do so.2? 
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Garbage placed for collection in an area 
accessible to the public is not subject to 
an expectation of privacy that society 


recognizes as reasonable. 


Motor Vehicles 

Stopping motor vehicles on a highway 

or at a checkpoint. The U.S. Supreme 
Court has ruled that an officer may not 
stop a car traveling on a highway 
simply to check the operator’s driver’s 
license. To stop a vehicle, an officer 
generally needs reasonable suspicion 
that the driver has violated a law.** 
Using the Fourth Amendment’s balan- 
cing test from Terry v. Ohio, discussed 
earlier, the Court concluded that the 
marginal contribution to highway safety 
resulting from this kind of license check 
cannot justify subjecting all vehicle 
drivers to being stopped at the unbridled 
discretion of law enforcement officers. 

However, in the same opinion, the 
Court indicated that driver’s license 
checkpoints would be constitutional. 

A typical checkpoint is set up at a 
designated place on a highway, and all 
cars are stopped to check driver’s 
licenses.*° Reasonable suspicion of a 
driver’s license violation, another traffic 
violation, or criminal activity is not 
required to stop a car at the checkpoint. 
Most state appellate courts, including 
North Carolina’s, have upheld such 
checkpoints. 

The U.S. Supreme Court also has 
upheld the validity of checkpoints for 
impaired drivers.** Using the Fourth 
Amendment’s balancing test, the Court 
concluded that the state’s interest in 
combating impaired driving outweighs 
the intrusion on motorists of being 
briefly stopped at these checkpoints. 

On the other hand, the Court has 
ruled unconstitutional a vehicle check- 
point whose primary purpose is to 
detect illegal drugs.2’ The Court noted 
that it had approved checkpoints to deal 
with highway safety or to police the 
nation’s border.” But if it approved a 
checkpoint to detect illegal drugs, law 
enforcement officers could establish 
checkpoints for any conceivable law 
enforcement purpose.*'! The Court’s 
application of the balancing test under 
the Fourth Amendment was resolved in 
favor of an individual’s right to be free 
from governmental intrusion. 


Ordering the driver and passengers 
out of a vehicle. According to the U.S. 
Supreme Court, when officers have 
lawfully stopped a vehicle, they may 
order the driver and passengers out of it 
without articulating any reason for 
doing so.*2 Using the Fourth Amend- 
ment’s balancing test, the Court concluded 
that the strong governmental interest in 
an officer’s protection from assault by 
weapons that may be in a car outweighs 
the minimum intrusion on drivers and 
passengers when required to exit a car. 

Searching a vehicle with probable 
cause but no search warrant. When 
officers have probable cause to search a 
vehicle for evidence of a crime, and the 
vehicle is in a public place (that is, a 
place where a person does not have a 
reasonable expectation of privacy), they 
may seize the vehicle—whether it is 
moving or parked—without a search 
warrant. Also, they may search it where 
they seized it or take it to a law enforce- 
ment facility or another place and 
search it there. 

This legal principle is an exception to 
the general rule that officers may make 
a warrantless search with probable 
cause only when exigent circumstances 
justify a failure to obtain a search 
warrant—for example, when the evidence 
might disappear if they took the time to 
obtain a warrant. The U.S. Supreme 
Court and the North Carolina Supreme 
Court have justified this principle on the 
ground that people have a lesser expec 
tation of privacy in their vehicles than in 
their homes because government perva- 


SIV ely regulates vehicles. 


Government Conduct Subject 
to Other Laws 


Federal and state laws may go farther 


than the floor established by the Fourth 
Amendment, applying, for example, to 
private activities. The following sections 
highlight two areas covered by federal 
and state laws. 


Wiretapping and Eavesdropping 
Wiretapping and eavesdropping are 
pervasively regulated by federal and 
state laws. Therefore most of this discus- 
sion is based on these laws.*’ Although 
the Fourth Amendment is clearly 
implicated in many aspects of wire- 





tapping and eavesdropping, there have 
been relatively few Fourth Amendment 


rulings because federal and state laws 


are as restrictive as, and sometimes more 


restrictive than, the Fourth Amendment. 
These laws are quite complex, and this 
discussion will attempt to cover only 
some of the basic issues. * 

An important point to be made at 
the outset about these laws is that they 
often apply to private people’s activities 
as well as governmental activities, 
whereas the Fourth Amendment applies 
only to the latter. Thus anyone who vio- 
lates these laws may be subject to crimi- 
nal and civil penalties. 

intercepting telephone conversations. 
Generally, it is unlawful to use a device 
to intercept a telephone conversation 
(as well as voice communications over 
pagers).*” The law applies not only to 
regular telephones but also to cellular 
and cordless telephones—even though 
conversations on some of the latter may 
be intercepted by scanners and radios 
that many people own and use. 

North Carolina law enforcement 
officers may intercept telephone conver- 
sations, but they must obtain a special 
court order from a designated court, 
and the requirements for obtaining the 
court order are significantly more strin- 
gent than those for obtaining a search 
warrant.** 

However, neither federal nor North 


Carolina law makes it unlawful to tape- 
record a telephone conversation in 
which one party to the conversation has 
given prior consent to Its being tape- 
recorded.*? For example, law enforce- 
ment officers may tape-record (1) a 
telephone conversation between them- 
selves and a criminal suspect or (2) a 
telephone conversation between a 
government informant with a criminal 
suspect when the informant has given 
prior consent. (However, a person’s 
Sixth Amendment right to counsel may 
bar this activity under certain circum- 
stances.)*” Also, a private person may 
tape-record a telephone conversation 
between himself or herself and another 
party to the conversation.*! However, a 
spouse may not install a device on a 
telephone to tape-record his or her 
spouse’s telephone conversations with 
third parties unless the other spouse has 
given prior consent.*? 

Using a device to intercept oral 
communication. It is illegal under federal 
and state law to use a device to intercept 
an oral communication under circum- 
stances in which a person has a reason- 
able expectation of privacy. This is the 
same standard as the Fourth Amend- 
ment standard adopted in Katz v. United 
States.*> Thus a person who places an 
eavesdropping device in a bedroom to 
listen to or to record oral communica- 
tions violates federal and state law— 


Garbage placed 
at the curb for 
collection is 
fair game for 
law enforce- 
ment officers 
to search. 


assuming, of course, that a party to 
the communications did not give prior 
consent to the use of the device there. 
On the other hand, a person who 
secretly records an open city council 
meeting does not violate federal or 
state law because council members 
and other speakers do not have a 
reasonable expectation of privacy that 
their statements will not be recorded 
by others. 

As with telephone conversations, a 
law enforcement officer or a private 
person does not violate federal or state 
law when he or she surreptitiously tape- 
records a conversation with another 
person if one party to the conversation 
has given prior consent to the recording.“ 
The U.S. Supreme Court and the North 
Carolina Supreme Court also have ruled 
that a law enforcement officer’s conduct 
under these circumstances does not 
violate the Fourth Amendment because 
a person does not have a reasonable 
expectation of privacy in a conversation 
with another person who happens to be 
a law enforcement officer or an agent of 
the officer.*5 A person contemplating 
criminal activity takes the risk that the 
person with whom he or she is convers- 
ing is an officer or someone who may 


report the conversation to an officer. 

Intercepting or reading electronic mail 
(e-mail). Officers may not intercept and 
read an e-mail message during its 


SPRING 2002 17 





transmission without a special court 
order, as described earlier for interception 
of telephone conversations.*° However, 
in officer does not need a special court 
order once the mes 
sage has been trans- 
mitted. If a message 
has been unopened 
for 180 days or less, 
only a search warrant 
Is necessary to read 
it.4” If a message has 
been opened, or if 
it remains unopened 
for more than 180 
days, then an officer 
may read the message 
by obtaining a search 
warrant or, with 
notice to the recipient 
of the message, by 
obtaining a subpoena 
or a court order.* 
I he law allows de 
layed notice to the 
recipient under certain circumstances.* 
Additional provisions allow a law 
enforcement officer to obtain subscriber 
information.*’ Further, they sometimes 
permit service providers to disclose 
information to officers voluntarily. 
Conducting video surveillance. Non 
aural video surveillance (surveillance that 
does not record oral communications) is 
not regulated by federal or state wire- 
tapping or eavesdropping laws.** How- 
ever, video surveillance directed at places 


wl 


1ere a person has a reasonable expec- 
tation of privacy is a search under the 
Fourth Amendment, and usually a search 
warrant is required to conduct the sur- 
veillance.*’ For example, officers need a 
search warrant to place a nonaural 
video camera on a utility pole to record 
all activities in a person’s backyard, 
when the backyard is surrounded by a 
ten-foot-high fence.** On the other 
hand, a nonaural video camera directed 
at people on a public street or sidewalk 
to observe possible drug transactions 
does not implicate anyone’s reasonable 
expectation of privacy and may be 
used without a search warrant or other 


legal authorization. 
Records in a Third Party’s Possession 


The U.S. Supreme Court has ruled that 


a person does not have a reasonable 
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Neither federal nor North 
Carolina law makes it unlawful 
to tape-record a telephone 
conversation in which one 
party to the conversation has 
given prior consent to its being 
tape-recorded. 


expectation of privacy in his or her 
bank records.*> The Court reasoned that, 
in revealing his or her financial affairs 
to another, a bank customer takes the 
risk that the informa- 
tion will be conveyed 
by that person or 
institution to the gov- 
ernment. However, 
the North Carolina 
General Assembly has 
enacted legislation 
that requires law en- 
forcement officers to 
obtain appropriate 
legal process (a search 
warrant, a court or- 
der, or a subpoena) to 
obtain bank records.* 

A U.S. Supreme 
Court case makes 
clear that a person 
does not have a 
reasonable 
expectation of 
privacy in his or her telephone records, 
including telephone numbers dialed 
from or to a telephone.*’ However, 
Congress has enacted legislation that 
requires law enforcement officers to 
obtain appropriate legal process to 
obtain telephone records.** Further, the 
North Carolina General Assembly has 
enacted legislation requiring a law 
enforcement officer to obtain a court 
order to use a device that records 
numbers dialed from or to a 
telephone. 

Many other records, such as personnel 
or school records, are subject to federal 
and state laws regulating disclosure. 

The protections for those records are 
discussed elsewhere in this issue of Popu- 


lar Government (see pages 33 and 36). 


Conclusion 


This article has briefly surveyed some 
privacy and law enforcement issues 
involved with the Fourth Amendment 
and federal and state legislation. With 
constant technological advances, debate 
will become more intense about the 
proper balance between a person’s right 
to privacy and the government’s need to 
investigate crimes. These issues will be 
the subject of future court decisions and 
federal and state legislative activity that 


will continue to define the scope of 
individual privacy and law enforcement 
authority. 
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person who was present during the entire 
video surveillance had given prior consent to 
it or if exigent circumstances existed to excuse 
the requirement of a search warrant. 

54. United States v. Cuevas-Sanchez, 821 
F.2d 248 (Sth Cir. 1987). Some courts have 
imposed rigorous requirements for searc h 
warrants for video surveillance. See, e.g., 
United States v. Koyomejian, 970 F.2d 536 
(9th Cir. 1992). 

55. United States v. Miller, 425 U.S. 435 
{ 1976). 

56. G.S. 53B-1 through -10. See also FARB, 
ARREST, SEARCH, AND INVESTIGATION, at 85. 

57. Smith v. Maryland, 442 U.S. 735 (1979). 
Although the Smith Court ruled only that a 
person does not have a reasonable expectation 
of privacy in telephone numbers that a person 
dials on his or her telephone, the ruling clearly 
would also apply to telephone numbers dialed 
to that telephone and to telephone records 
maintained by the telephone company. 

58. See FARB, ARREST, SEARCH, AND 
INVESTIGATION, at 86. 

59. G.S. 15A-260 through -264. See also 
FARB, ARREST, SEARCH, AND INVESTIGATION, at 
84-85. A “pen register” records numbers 
dialed from a telephone, and a “trap-and- 
trace device” records numbers dialed to a 
telephone. 
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orth Carolina law reflects a 

strong general policy of openness 

in governmental operations, 
expressed in its public records and open 
meetings statutes. Because of these sta- 
tutes, the great mass of public records, 
especially the business records of govern- 
ment, is open to public access, and 
most meetings of most public bodies in 
North Carolina are conducted entirely 
in public. 

Almost all citizens applaud these 
statutory policies, which North Caro 
lina shares with the other forty-nine 
states. Sometimes, however, the statutes 
permit public access to governmental 
meetings, and especially to governmental 
records, with results that at least some 
people consider invasive of their privacy. 
\ client of a community development 
agency or a person whose occupation is 
regulated by a state licensing board 
might suddenly begin receiving junk 
mail because an advertiser has acquired 
the agency’s list of clients or the licensing 
board’s list of licensees through a public 
records request. Or a citizen who has 
written a letter to her city’s manager 
might find it published in the local 
newspaper, which has obtained a copy 
pursuant to the public records law. 

Nothing in the public records statute 
protects the people in the preceding 
examples whose sense of privacy has 
been violated. The General Assembly 
has, however, created numerous excep- 
tions to the general demands of open- 
ness established in the public records 
and open meetings statutes. And in most 


cases it has done so because of concerns 
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An Overview of Protected and 
Public Information in North Carolina 
David M. Lawrence 


about privacy: almost 
all the exceptions to 
both statutes can be 
explained, at least in 
part, as legislative 
recognition of the 
legitimacy of certain 
claims of privacy. 
What kinds of infor- 
mation, then, do these 


exceptions protect? 


Information about 
Private Citizens 
and Entities 


Che broadest excep- 
tions involve infor- 
mation that govern 
ment holds about 
private citizens or 
entities, either because they deal with 
government or because government 
deals with them. These citizens and 
entities May pay taxes to government, 
receive special benefits from govern- 
ment, do business with government, be 
investigated by government, or other- 
wise interact with government. How- 
ever the interaction takes place, the 
government acquires information about 
the private citizen or entity, and some of 
that information is likely to be considered 
personal or otherwise private by the 
citizen or the entity. Following are some 
important categories of private infor- 
mation held by government that are 
shielded by statute from public access or 
public meetings. 

Tax information. Most of the infor- 
mation about taxpayers held by the 
North Carolina Department of Revenue 
is made confidential by statute, as is tax 
information held by local governments 
that reveals a taxpayer’s income or gross 


The great mass of public 
records, especially the business 
records of government, is open 
to public access, and most 
meetings of most public 
bodies in North Carolina are 
conducted entirely in public. 


receipts.? The confi- 
dentiality of tax infor- 
mation is particularly 
strong: improper 
release of the informa- 
tion is a crime, and 
the person responsible 
for the release must be 
terminated from 
public employment 
and may not hold a 
public job for five 
years. 

These privacy 
policies, however, do 
not apply to most of 
the information held 
by local tax offices 
arising from adminis- 
tration of the property 
tax. Although a per- 
son’s income is not public, the value of 
his or her house is. 

Information about children and 
students. Information held by govern 
ment about children is frequently 
excepted from public access. Further, 
federal law conditions federal aid to 
state and local education on the 
recipient’s maintaining the confiden- 
tiality of student records. Accordingly, 
North Carolina law excepts student 
records from the public records act.’ In 
addition, it excepts records of juveniles 
—both those enmeshed in the criminal 
justice system and those protected by 
social services agencies.* 

Information about social services 
clients. Although the names of people 
receiving public assistance are public 
record, as is the amount they receive 
each month, all other information about 
them in the records of social services 
departments is confidential, and 
releasing the information in violation of 
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the statute is a misdemeanor.’ This 
balance recognizes the public interest in 
monitoring social service programs but 
also refuses to force public assistance 
recipients to give up all claims of 
privacy as a condition of receiving aid. 

Medical information. North Carolina 
law generally protects the confiden- 
tiality of medical records, and excep- 
tions to the public records law extend 
confidentiality to medical records held 
by public hospitals, public health 
departments, mental health agencies, 
and other public health facilities.° (For 
more information on this topic, see the 
article on page 44.) 

Records of library use. Public libraries 
are prohibited from releasing informa- 
tion that indicates what books library 
patrons have checked out or how they 
have otherwise used the library. 

Private telephone numbers. Most 
telephone numbers, of course, are listed 
in public telephone directories. Not only 
do people not consider their telephone 
number to be within their zone of 
privacy, but they wish it to be known. 
For various reasons, though, some 
numbers are considered private 
information and are unlisted. In at least 
two situations, state law protects the 
privacy of unlisted numbers. First, 911 
centers normally seek the cooperation 
of telephone companies in obtaining all 
local telephone numbers for the 911 
system. State law recognizes that some 
of the numbers provided by the tele- 
phone company may be unlisted and 
prohibits the release of any numbers 
received from the telephone company 
in this circumstance.* Second, a public 
employee’s home telephone number is 
a part of the employee’s personnel file 
that is not available to the public. 

Information obtained in criminal 
investigations. State law excepts from 
the public records law most of the 
information gathered by law enforce- 
ment agencies in the course of criminal 
investigations.’ A major reason for the 
exception is to protect the integrity of 
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in investigation; its subjects should not 
be privy to all its details. 

But privacy considerations also shape 
this exception. First, the statute recog- 
nizes the privacy concerns of victims of 
crime and limits public access to their 
names and addresses, especially if a 
victim might be subject to harassment 
from suspects. Second, the statute 
recognizes that many suspects in a 
criminal investigation are ultimately 
cleared from suspicion. Apparently, 
legislators see no Loc »d purpe yse in 
disclosing that these people were ever 
suspects. Therefore, unlike criminal 
investigation records in some states, 
those in North Carolina do not become 
public once an investigation is 
completed; they are permanently 
shielded from public access. 

Proprietary business information. 
Entities that wish to do business with a 
government agency often possess trade 
secrets integral to their business. As part 
ot selecting the businesses with which 
they will deal, local governments and 
state agencies (as well as private 
businesses) often require their prospec- 
tive business partners to reveal some of 
these secrets. Governments also may 
acquire business trade secrets through 
their regulation of businesses or busi- 
ness activities. The General Assembly 
has determined that a business should 
not have to relinquish its trade secrets in 
order to do business with state or local 
government, or because it is being 
regulated by government. So if a 
business reveals trade secrets to a local 
government or a state agency, that 
government or agency is prohibited 
from releasing the secrets. ' 


Information about 
Public Employees 


As employ ers, local governments and 
state agencies maintain a wide variety 
of information about their employees, 
just as private employers do. A typical 
personnel file might include evaluations, 
letters of reference, personnel actions, 
results of drug and medical tests, a 
salary history, results of job tests, and 
records of internal investigations. For 
a private-sector employee, all this 
information is private. For a public 
employee, however, it is public unless 
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excepted by statute from the public 
records law. 

There are good arguments to be 
made for allowing public access to at 
least some of the information in a public 
employee’s personnel file. Indeed, in a 
sense the public as a whole is the 
employer of a public employee and 
therefore might be thought entitled to 
the same rights of inspection of 
personnel files that 
private employers 
have. On the other 
hand, a private-sector 
employee’s personnel 
files are not open to 
the stockholders of 
his or her company, 
even though they are 
the owners. Many 
public employees 
think that they 
should be entitled to 
the same privacy as 
private-sector 
employees. 

The General 
Assembly has 
responded to these 
arguments by 
enacting a series of 
personnel privacy 
statutes that attempt 
to forge a balance 
between the public’s records law. 
interest in monitoring 
the performance of government and 
its employees, and the employees’ 
interest in maintaining some privacy 
about their everyday work life.'' The 
statutes make some information in a 
public employee’s personnel file 
completely public, especially salary, the 
amount of the last salary change, and 
the nature and the date of the most 
recent personnel action affecting the 
employee. All else is excepted from 
automatic public access. 

The statutes do, however, permit a 
number of more limited rights of access 
to or release of information from the 
files. Some are intended simply to 
facilitate the work of government 
itsel(—for example, a supervisor may see 
what is in an employee’s personnel file, 
and the file’s custodian may release 
most information in a file to an official 
of another government agency. 


The treatment of attorney— 
client communications 

under the public records law 
is less protective of govern- 
mental clients. The state 
supreme court has held that 
the privilege itself does not 
automatically create an 
exception to the right of 
public access under the public 


One of these limited rights of access 
is concerned with providing public 
information. The head of the appropri- 
ate agency or local government may 
release to the public information about 
a personnel action, including the 
reasons for the action, if doing so is 
“essential to maintaining the integrity” 
of the agency, “essential to maintaining 
public confidence” in the local govern- 
ment, or “essential to 
. .. Maintaining the 
level or quality of 
services” provided by 
the agency or local 
government.'? 

The concerns for 
employees’ privacy 
embodied in the per- 
sonnel privacy statutes 
are repeated in an 
important exception to 
the open meetings law. 
That exception permits 
public bodies to hold 
closed sessions to 
consider the qualifi- 
cations, the perfor- 
mance, and the fitness 
of a public employee 
or an applicant for 
employment, and to 
hear or investigate 
complaints by or 
against public em- 


pl yyees. 


The Government's Own Privacy 


A final set of exceptions to both the 
open meetings and the public records 
law recognizes that government agen- 
cies and local governments also have a 
need for privacy, or at least for secrecy. 
The policy considerations in this category 
of information, though, are clearly much 
more complicated than in either of the 
two preceding categories. Following are 
some examples of the protections. 
Attorney-client confidentiality. A 
private individual or business entity is 
entitled to discuss legal matters in 
confidence with his, her, or its attorney, 
and to have written communications 
with the attorney also protected, even 
from being produced in a lawsuit. The 
considerations that underlie this policy 
also apply when the client is a govern- 





ment or a government agency, and that 
fact has been recognized, at least in 
part, by the General Assembly. One of 
the exceptions to the open meetings law 
permits a public body to meet in closed 
session with its attorney to discuss matters 
that are protected by the attorney-client 
privilege, and the statute expressly 
acknowledges that the privilege applies 
to government entities. '* 

The treatment of attorney-client 
communications under the public 
records law, however, is less protective 
of governmental clients. The state 
supreme court has held that the privilege 
itself does not automatically create 
an exception to the right of public 
access under the public records law. 
Rather, the General Assembly must 
define the scope of the privilege for 
public records purposes.'* The General 
Assembly has chosen to protect only 
one category of attorney-client 
communications—those from attorney 
to client respecting ongoing litigation." 
The result is that many other commu- 
nications between a public entity’s 
attorney and the entity that would be 
privileged if made to a private citizen or 


entity are open to public access under 


the public records laws. 


Adversarial situations. Like business 
organizations, governments are fre- 
quently involved in relationships that 
are somewhat adversarial. If the involved 
organizations were both private, each 
could develop its strategies without 
undue fear that the other party would 
become privy to them. When one of the 
organizations is a local government or a 
state agency, however, the demands of 
the open meetings or public records 
laws might force the governmental 
entity either to make its strategy in 
open meetings or make its strategy 
known to the other party through 
public records. The General Assembly 
has recognized this as a problem in 
select circumstances but not as a general 
principle and not in any patently 
consistent way. The exception in the 
open meetings law noted earlier, for 
attorney-client discussions, specifically 
mentions the need to have confidential 
discussions when the governmental 
client is involved in litigation. Similarly, 
another exception in the open meetings 
law permits a public body to hold a 
closed session when it is developing a 
negotiating position for the acquisition 
of real property.” 

But other potentially adversarial 


North Carolina’s 
public records law 
makes individuals’ 
tax information 
confidential. 


situations are not protected by excep- 
tions to the open meetings or public 
records laws. The open meetings law 
contains no exception when a govern- 
ment is conveying rather than acquiring 
property, no exception when it is 
acquiring (let alone conveying) personal 
property, and no exception when it is 
negotiating a contract not involving 
acquisition of real property. Similarly, 
even though the open meetings law 
permits lawmakers in a closed session to 
discuss developing a negotiating posi- 
tion for acquisition of real property, the 
public records law contains no excep- 
tion that would protect any property 
appraisal the government may have had 
made as part of its negotiations. 
Government as business competitor. 
Occasionally, governmental entities 
engage in activities in which they com- 
pete with private counterparts—for 
example, in health care, utility, cable 
television, and solid waste operations. 
Normally, business competitors keep a 
shroud of privacy over their operations, 
to maintain any competitive advantage 
they may have. Obviously, the general 
principles of the public records and open 
meetings laws conflict with business 
secrecy. Therefore the General Assembly 
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The long-standing policy of the 
North Carolina General Assembly 
is that the work of government 
be conducted in the open. 


has permitted limited exceptions to pro- 
tect government-operated businesses. 
One statute excepts from the public 
records law “information relating to 
competitive health care activities.” 
Another excepts discussions ot pre pe sed 
or existing contracts entered into by the 
state’s joint power agencies (two entities 
through which cities with electric distri- 
bution systems helped finance nuclear 
power facilities).!” These are the only in- 
stances, however, of the General Assem- 
bly’s recognition of the special demands 
that competition might make on govern- 
ments for privacy in their operations. 
No statute, for example, excepts from 
the public records law the competitive 
strategies of a city that distributes 
natural gas or a county that operates a 


facility for solid waste disposal. 


Summary 


Che general policies of North Carolina 
law open up to public viewing and 
inspection the meetings and the records 
of state agencies and local governments. 
For the most part, these policies govern 
the day-to-day operations of government. 
The General Assembly has recognized, 
however, that sometimes the claims of 
privacy are strong enough to justify 
exceptions to these general policies. Most 
of the exceptions fall into three broad 
categories: information that government 
has received from or collected about 
individuals or private entities, and dis- 
cussions about that information; infor- 
mation that government has received or 
created about governmental employees, 
and discussions about those employees; 
and situations in which the government 


itself has a strong need for privacy. 


Notes 


1. The public records law is centered in 
Chapter 132 of the NoRTH CAROLINA 
GENERAL STATUTES (hereinafter G.S.), but 
exceptions to the right of public inspection are 
scattered throughout the General Statutes. 
The open meetings law is found in G.S. 143- 
318.9 through -318.18. 
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2. G.S. 105-259 for the N.C. Department 
of Revenue; G.S. 153A-148.1 for counties; 
G.S. 160A-208.1 for cities. 

3. G.S. 115C-402. Other laws bar 
disclosure of information about students. See 
the article on page 36. 

4. G.S. 7B-2901, -3000. -3001. 

5. G.S. LO8A-80. 

6. G.S. 131E-97 (health care facilities); 
G.S. 130A-12 (public health departments); 
G.S. 122C-52 (mental health agencies); G.S. 
143-518 (emergency medical services 


providers). 
8. 


9. GS. 


of all public employees in North Carolina. 
Rather, several statutes apply to different 


poe 
te 


if. 


: 
~~ 


of: 


kinds of governments. These statutes are 
broadly comparable, but, except for the city 
and county statutes, not identical. The 
principal statutes are G.S. 126-22 through -30 
state employees); G.S. 153A-98 (county 
employees); G.S. 160A-168 (city employees); 
ind G.S. 115¢ 


sche T yl empk »yees). 


-319 through -321 (public 

12. The different statutes use slightly 
different criteria for justifying release of this 
information. 

13. G.S. 143-318.11(a)(6 

14. G.S. 143-318.11(a)(3). 

15. News and Observer Publ’g Co. v. Poole, 
330 N.C. 465, 482-83, 412 S.E.2d 7, 17 
(1992). 


16. 


18. 
19. 





Privacy and the Courts 


James C. Drennan 


It is desirable that the trial of causes should take place under the public eye, not 


because the controversies of one citizen with another are of public concern, but 


because it is of the highest moment that those who administer justice should 
always act under the sense of public responsibility, and that every citizen should 


be able to satisfy himself with his own eyes as to the mode in which a public 


duty is performed. 


—Justice Oliver Wendell Holmes, in Cowley v. Pulsifer’ 


To... broadcast the painful, and sometimes disgusting, details of a 


divorce case, not only fails to serve any useful purpose in the community, 
but, on the other hand, directly tends to the demoralization and corruption thereof, 


by catering to a morbid craving for that which is sensational and impure. The judicial 


records of the state should always be accessible to the people for all proper purposes, . . . 
but they should not be used to gratify private spite or promote public scandal. 
—In re Caswell’s Request* 


s these quotations demonstrate, 

courts have long been grappling 

with the tension between the 
privacy interests of people who use the 
courts and the public’s interest in 
knowing what is going on in the courts. 
The tension persists today, although it 
sometimes takes twists and turns, as is 
evident in the debate over the use of 
potentially closed military courts in the 
aftermath of the terrorist attacks of 
September 11, 2001. The specifics of 
the issues that state courts face are 
different from those faced by the federal 
government in setting up military 
courts, but the fundamental tension 





The author is an Institute of Government 
faculty member who specializes in court 
administration issues. Contact him at 
drennan@iogmail.iog.unc.edu. 


between closing courts to protect a 
specific party’s interest and opening 
them to serve the public’s interest is 
similar. This article describes the ways 
in which North Carolina resolves those 
tensions in its courts. 

In most instances the answer to the 
openness-or-privacy issue is that open- 
ness prevails. That is a cost of having a 
public court system. The following 
quote from the U.S. Supreme Court is 
fairly typical of courts’ statements on 
the subject: 


The right of access to criminal trials 
plays a particularly significant role in 
the functioning of the judicial process 
and the government as a whole. Pub- 
lic scrutiny of a criminal trial enhances 
the quality and safeguards the integ- 
rity of the factfinding process, with 


benefits to both the defendant and to 
society as a whole. Moreover, public 
access to the criminal trial fosters an 
appearance of fairness, thereby 
heightening public respect for the 
judicial process. And in the broadest 
terms, public access to criminal trials 
permits the public to participate in 
and serve as a check upon the judicial 
process—an essential component in 
our structure of self-government. In 
sum, the institutional value of the 
open criminal trial is recognized in 
both logic and experience.* 


Most courts and legislatures, when 
faced with the issue, find that justice, 
and society’s pursuit of it, are too 
important to be performed away from 
the public’s scrutiny. The real debate 
arises mostly when the information that 
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is considered involves private, personal 
details of people’s lives. Those details 
can include, among other things, the 


following: 


e Financial records. For example, 
contests of wills may involve detailed 
discussions of a family’s assets and 
liabilities, or a person’s income often 
is introduced in evidence. 

Testimony about intimate sexual 
matters or failed relationships with 
children or other family members. 
For example, family law disputes 
often involve allegations of sexual 
dysfunction or marital infidelity, and 
sexual orientation or difficulties that 
children are having in school or in 
social settings frequently are at issue 
in custody cases. 

Medical information. For example, 
guardianship proceedings almost 
always involve detailed testimony 
and reports about the physical and 
mental condition of the person Ww ho is 
alleged to be incompetent. Also, 
nearly all claims for personal injury 
require evidence of the injury. 
Further, jurors often have to reveal 
publicly that they cannot hear or 
cannot sit for prolonged periods. 
Sensitive business information. For 
example, in a marital property dis- 
pute, the proceedings may reveal that 
a party’s business is in financial 
trouble or reveal other information 
that a business owner would prefer 
remain confidential. 


Such information is highly relevant, and 
the case cannot be disposed of fairly 
without it. That does not make its being 
disclosed any less embarrassing, and the 
disclosure is all the more unpleasant 
because it usually is compelled rather 
than volunteered. 

One unfortunate consequence is 
that, when they can, people may avoid 
the courts to protect their privacy. 

But in many instances, avoidance is 

not an option. For example, a couple 
may not divorce except through the 
public courts, or people who are injured 
may find that litigation is their only 
recourse, even though they have to 
submit to personal questions about their 
private lives. In such instances, people 
may ask the courts or their legislators 
for help in preserving their privacy. 
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The concern may be that of a litigant, a 
witness, a victim, or a juror. 

This tension most often arises in rela- 
tion to two rights of the public: the right 
to observe the proceedings and the right 
to look at the records later. The develop- 
ment of computer networks and large 
automated databases has generated the 
additional question of whether computer 
records are different from paper records. 
This article addresses each issue and then 
discusses the extent to which the privacy 
interests of a special category of court 


participants—jurors—are protected. 


The Right to Attend 
Court Proceedings 


The general rule is that court proceedings 
are open to the public. There are two 
kinds of exceptions to that rule: First, 
the presumption that 
the court will be open 
can be overridden in 
specific cases.* 
Second, in some in- 
stances the General 
Assembly has pro- 
vided by statute that 
certain types of pro- 
ceedings are either 
always closed to the 
public or may be 


closed by the judge. 


General Rule of 
Openness 

The general presump- 
tion comes from 
Article I, Section 18, 
of the North Caro- 
lina Constitution, 
which provides that “[c]ourts shall be 
open; every person for an injury done 
him in his lands, gore yds, person, or 
reputation shall have remedy by due 
course of law; and right and justice shall 
be administered without favor, denial or 
delay.” This provision was probably 
inserted to make it clear that courts 
were available to all people who needed 
to use them to resolve disputes, 
regardless of status.’ However, the 
North Carolina courts have interpreted 
it also to mean that court proceedings 
are generally open to the public and the 
press. In the words of the North 


A couple may not divorce ex- 
cept through the public courts, 
or people who are injured may 
find that litigation is their only 
recourse, even though they have 
to submit to personal questions 
about their private lives. 


Carolina Supreme Court, “[T]he open 
courts provision of [the N.C. 
Constitution] guarantees a qualified 
right on the part of the public to attend 
civil court proceedings.”° 

A similar right applies in criminal 
cases.” The U.S. Supreme Court has held 
that the First Amendment rights to 
freedom of speech and freedom of the 
press contain an implicit, qualified right 
of the public to attend criminal trials.* 
However, both the North Carolina 
Supreme Court and the U.S. Supreme 
Court have ruled that the right is not 
absolute. In criminal cases the U.S. 
Supreme Court has indicated that the 
right to attend is significant. To limit 
that right in order to prevent the dis- 
closure of sensitive information, the 
government must demonstrate that a 
closing of the court is necessary to serve 
a compelling 
governmental interest; 
that the closing is 
n rrowly tailored to 
serve that interest; 
and that there is no 
reasonable alternative 
to the closing.’ 

North Carolina’s 
courts apply a similar 
standard in deter- 
mining if civil pro- 
ceedings may be 
closed.'” If a court 
determines that they 
should be closed, it 
must make specific 
findings to support its 
decision. That is a 
difficult standard for 
anyone seeking 
closure to meet, and 
as a result, closing of civil proceedings is 
not common in North Carolina.'! 

In the situations in which courts have 
been closed to the public, privacy is not 
always the interest asserted. For example, 
the North Carolina Supreme Court has 
ruled that court reviews of medical peer 
reviews of doctors to determine their 
fitness to practice in a hospital may be 
conducted in closed court hearings, to 
preserve the public’s interest in “effective, 
frank, and uninhibited exchange among 
medical peer review members.” !? That 
kind of exchange is necessary to preserve 
the quality of health care delivered by 





doctors. Therefore, opening the hearing 
would compromise the ability of peer 
review agencies to gather full and 
complete information. Although closing 
the court protects the privacy of the 
doctor under review, protection of his 
or her privacy is not the justification for 
the closing. 

Similarly, when criminal proceedings 
are closed to the public, a common rea- 
son cited is that extensive press coverage 
threatens the defendant’s ability to get a 
fair trial. That concern is greatest at early 
stages of the proceeding, such as in a pre- 
liminary hearing or in jury selection." 
Thus, although a disclosure of informa- 
tion may be embarrassing or otherwise 
involve a loss of privacy by the party 
affected, it is not often the basis for a 
court to close proceedings in North Caro- 
lina. No appellate cases or legislative 


actions in this state allow embarrass- 
ment alone to support the closing of a 
court proceeding. 


Statutory Exceptions 

In the following instances, the General 

Assembly has enacted statutes providing 

that court proceedings not be open to 

the public. In most of these cases, the 
privacy interest being protected is that 
of either a person testifying or a person 
who is a party to the action. 

e Juvenile cases. G.S. 7B-2402 pro- 
vides that cases involving the juvenile 
code'* are open to the public “unless 
the court closes the hearing or part of 
the hearing for good cause.” If the 
hearing is closed, the court may allow 
any person directly involved in the 
proceeding to attend. A juvenile may 
ask that the hearing be open, and the 


Court cases involving contests 
of wills may delve deeply into 
private financial information. 


court must honor that request. Juve- 
nile matters have historically been 
closed to the public, but the trend is 
toward open hearings. 

Involuntary commitments. G.S. 
122C-267/(f) provides that hearings 
to determine if a person should be or 
remain involuntarily committed to a 
state mental health facility are closed 
to the public unless the person 
requests that the hearing be open. 
This statute was enacted in 1985; 
commitment hearings had not been 
closed before that. 

Adoptions. G.S. 48-2-203 provides 
that any judicial hearing in an adop- 
tion be conducted in closed court. 
Judicial consent for a minor’s 
abortion. North Carolina requires 
that if a pregnant girl under age 
eighteen is seeking an abortion, 

she must obtain the consent of a 
parent. If she does not want to 

seek a parent’s consent, G.S. 90-21.8 
allows her to apply to a district judge 
for a waiver of parental consent. 
That proceeding is confidential and 
is to be conducted in such a manner 
that the girl’s identity is kept confiden- 
tial throughout the process, including 
any appeals.'» 

Testimony of a victim of a sexual 
offense. G.S. 15-166 allows trial 
judges to “exclude from the court- 
room all persons except the officers 
of the court, the defendant, and 
those engaged in the trial of the case” 
when a victim in a rape or sexual 


offense case is testifying. 


The extent to which the proceedings 
are closed under these exceptions is a 
function of the privacy interest to be 
protected. When the party to be pro- 
tected is not on trial—for example, a 


rape victim—the protection is narrowly 
drafted to shield only the victim’s 
testimony. When the party to be pro- 
tected is on trial in some fashion, the 


entire proceeding is shielded from 
public view. 

Perhaps the most striking feature of 
the list of exceptions is how short it is. 
The range of embarrassing matters that 
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can be covered in court is remarkably 
broad, but the legislature has provided 


only five exceptions. 


Access by Media 

lo emphasize the importance of public 
access to the courts, the General Assem- 
bly also has enacted a statute making it 
clear that the news media may publish 
any report they see fit on any matter 
that occurs in open court, and that any 
attempt by a court to prohibit anyone 
from publishing a report about anything 
that occurs in open court is “null and 
void, and of no effect.” '* That statute is 
consistent with U.S. Supreme Court 
decisions holding that the truthful pub- 
lication of facts obtained from courts 
may not be punished.'” North Carolina 
law also provides that no person may be 
held in contempt of court for the content 
of any broadcast or publication unless 
the dissemination presents “a clear and 
present danger of imminent and serious 
threat to the administration of criminal 
justice.” 

In addition, the news media may 
assert their right to attend court pro- 
ceedings (or to review the records of a 
case) by filing a motion in the case.'” 
The statute granting this privilege was 
enacted in the 2001 session of the North 
Carolina General Assembly. !t effectively 
reversed a North Carolina Supreme 
Court decision that news organizations 
had to file a separate lawsuit seeking 
access.*” News organizations com- 
plained that doing so would take time 
and that the trial in which the issue of 
access arose would be over before the 
issue could be raised. 

Although the public has a right to 
attend court proceedings, relatively few 
members of the public actually do 
attend them. Most people learn what 
they know about courts from the news 
media. Courts treat newspaper and 
other reporters in the same way that 
they treat other members of the public. 
Different rules apply to television and 
photographic coverage, however. 

Television coverage and photographic 
coverage have the potential to reach 
many more people than can attend a 
proceeding in person, and they can do 
so visually, revealing a person’s identity 
more effectively. Courts have historically 
been reluctant to allow televising or 
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photographing of court proceedings 
because they have feared that a camera’s 
presence would turn the trial into a 
search for publicity instead of for justice. 

The U.S. Supreme Court has not found 
that the right of the 


public to attend court : ‘Conner 


proceedings includes 
the right to televise or 
photograph them.?! 
As a result, the issue is 
left to the states to de- 
cide. Many states have 


OF CHAPEL Hitt HERALD 


either denied access 
or restricted it. North 
Carolina law on 


Courtesy 


this matter was estab- 
lished in a rule 
adopted by the North 
Carolina Supreme 
Court.” It presumes 
that television cover- 
age and still photo- 
graphy of most court 
proceedings should be 
allowed but gives the 
presiding judge the 
discretion to prohibit 
them. The court 


no effect.” 


established some exceptions for circum- 
stances in which it felt that no such 
coverage should be allowed: 


¢ Adoptions, juvenile cases, and 
custody, divorce, and alimony actions 
Cases involving evidence of trade 
secrets 
Testimony of minors and victims 
of sex crimes 
Jurors generally 


Court Records 


General Rule of Openness 

Review of court records affects privacy 
differently than open court proceedings 
do. Written records are permanent. 
They may contain only summary 
information about a criminal or civil 
trial or proceeding, but that record, if it 
is public, may be reviewed long after the 
event has taken place. If a person is 
convicted of a drug offense at age 
eighteen, he or she is not likely to feel 
the same degree of embarrassment at 
the time of conviction that he or she will 
feel at age thirty or sixty. Permanent 
public records make it possible to find 


aye OD 
and gates DE stat a“ au ran int? 


The news media may publish 
any report they see fit on any 
matter that occurs in open 
court, and... any attempt by a 
court to prohibit anyone from 
publishing a report about 
anything that occurs in open 
court is “null and void, and of 


out about such convictions long after 
they have faded from the memories of 
most people. 

As is true with court closings, the 
general rule about court records is that 


they are open to 

ewe, 
grated 
Mert 
ajcono 
stared 


Bis, public inspection. In 
addition to the gen- 
eral public records 
statute, there is a 
specific statute making 
the court records main- 
tained by the clerk of 
court (the official 
records) open for in- 
spection.”> Also, 
North Carolina 
appellate courts have 
made it clear that the 
records held by the 
courts are public.”* 


Civil Cases 

There are statutory 
exceptions. Records 
of closed court pro- 
ceedings are usually 
closed.*' In some civil 
cases, tO protect a 
party or a witness from unreasonable 
annoyance, embarrassment, oppression, 
or undue burden or expense, the court 
may provide that depositions (the 
testimony of a witness taken in advance 
of a trial to discover evidence in the 
case) may be sealed and opened only 
with the approval of the court.*° 


Criminal Cases 

There also are instances in criminal 
courts in which records are not made 
available to the public. When a criminal 
defendant’s competency to stand trial is 
questioned, the reports of the medical 
personnel conducting the examination 
are sealed, and they become public 
records only if the reports are intro- 
duced into evidence.’ Also, presentence 
reports are not public records; only 
court officials with a need to see them 
may do so.** Similarly, material prepared 
by sentencing-services programs may be 
withheld from public inspection.”? 


Exceptional Cases 

Judges often are asked to seal court 
records in a specific case. In Virmani v. 
Presbyterian Health Services Corpora- 





A private company that 
has contracted with North 
Carolina’s Administrative 
Office of the Courts makes 
the state’s criminal records 
available on-line for a fee. 


tion, the North Carolina Supreme 
Court approved the sealing of various 
hospital records used as part of a court 
review of a physician’s fitness to serve at 
a hospital, in part on the basis of the 
legislature’s indication that such records 
should be confidential. The court held 
that, notwithstanding public records or 
related statutes, trial courts have the 


necessary inherent power granted 
them by Article lV, Section I of the 
North Carolina Constitution to con- 
trol their proceedings and records in 
order to ensure that each side has a 
fair and impartial trial A trial 
court may, in the proper circumstances, 
shield portions of court proceedings 
and records from the public; the 
power to do so is a power rightly 
pertaining to the judiciary as a 
separate branch of the Government, 
and the General Assembly has “no 
power” to diminish it in any manner. 


That language also could apply to 
records not classified by the legislature 
as confidential. The North Carolina 
Supreme Court instructed lower courts 
to use the power sparingly and only 
when necessary for the fair administra- 
tion of justice, or “where for reasons of 
public policy, the openness ordinarily re- 
quired of our government will be more 
harmful than beneficial.”*! A court 
exercising the power must first consider 
any alternatives to closure and then 
specify in writing the facts that support 
its decision. As is the case with motions 
to close court proceedings, the burden 
on the party seeking closure is high, and 
court records are rarely sealed. 


Settlements 
In practice, one important exception to 
the general rule of openness is in civil 
cases settled before trial. In settlement 
negotiations it is not unusual for one 
party to ask that the terms of the 
settlement be sealed and that such a 
provision be in the final settlement. 
The General Assembly has provided 
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that settlement documents in lawsuits ments allows the public courts to be 
against governmental agencies, except turned into private dispute resolution 
for malpractice actions against hospitals, forums. The effect is to keep from 
may not be sealed unless the court the public information that could 
determines that the presumption of help citizens, such as settlements for 


openness is overcome by an overriding injuries stemming from the use of 
interest in maintaining the confiden- defective or dangerous products.*® 


tiality of the proceeding and that the 
interest may not be served by any Computer Records 
measure other than sealing the docu- 
ments.*2 The statute states a preference 
that such records be open, however. 

In nongovernmental civil cases, there 


The official record of any court pro- 
ceeding is the paper record in the file of 
the case, maintained in the office of the 
clerk of court. That has implications for 
the ease of use of the record. For ex- 
ample, if a researcher wanted to do a 


is no such requirement, and the general 
authority described in Virmani applies. 
Unless the court exercises that authority, 
the public records law applies to the 
records of the case. Defendants involved 
in multiple lawsuits often seek closure 
to keep the terms of one settlement 
from affecting other cases. Sealing of 
settlements is controversial, as this 
excerpt from a legal manual prepared 
for news media personnel notes: 


systematic review of results in impaired 
driving cases, using the case files would 
require looking at hundreds of thou- 
sands of case files in 100 counties. It is 
not surprising that projects like that are 
seldom done using the original, or 
“source” documents, even though the 
results would be of great interest to the 
public. Similarly, looking at a person’s 
This trend [to seal settlements] is criminal history or the number of civil 
opposed by . . . news organizations judgments rendered against him or her 
because the sealing of court docu- would be an insurmountably difficult 
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task if the research had to be conducted 
in 100 courthouses. Even if the search is 
for a single record—a person’s record 
of being sued in one county, or his or 
her history of impaired driving in a 
county —the search must be conducted 
in the courthouse, during regular 
business hours. This often is not the 
most convenient place or time for the 
search to occur. 

Computers can change that—and 
they have. Much of the important 
information that is found in source 
documents for North Carolina’s courts 
also is maintained in a database on the 
state court system’s mainframe com- 
puter. This database often is referred to 
as “compiled records.” Although access 
to the database is easier in some ways 
—it can potentially be gained anytime, 
anywhere—it may be more difficult in 
other ways because navigating a com- 
puter-based record 
system often requires 
specialized knowl- 
edge about that 
system. 

The emergence of 
compiled records 
raises the important 
question of whether 
they should be treated 
in the same way as 
source records. In 
other contexts, gov- 
ernments have recog- 
nized that they are 
different. The best 
example is state 
criminal histories. In 
each state a central, 
automated repository 
of such information is 
available to all law 
enforcement person- 
nel. All the informa- 
tion in the repository has been obtained 
from public records, but it is not avail- 
able to the public.** In weighing the risk 
of harm from widespread dissemination 
of criminal records against the benefits 
to the public, Congress opted in favor 
of restricting access. 

As state court systems develop more 
powerful, centralized databases, they 
face the same issues. The report of a 
study by the Conference of State Court 
Administrators (composed of the chief 
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Much of the important infor- 
mation that is found in 
source documents for North 
Carolina's courts also is 
maintained in a database 

on the state court system's 
mainframe computer. This 
database often is referred 

to as “compiled records.” 


executive officers of the fifty state court 
systems) suggests that compiled records 
be treated in the same way as source 
records, and be equally available. The 
report recognizes, however, that there 
may be instances in which the content 
of the record should not be made public 
in either the source document or any 
compiled documents.** 

North Carolina’s statutes follow that 
policy.** There is no statutory prohibi- 
tion on dissemination of the court 
system’s compiled records. Thus the 
compiled records, like the source 
records from which they come, are pub- 
lic.” Records that are shielded from 
public inspection in their original form 
are not available in electronic formats. 
A person requesting a copy of public 
records “may elect to obtain them in 
any media in which the public agency is 
capable of providing them.”** 

Another way in 
which compiled 
electronic records 
differ from source 
records is that they 
also may be obtained 
from private busi- 
nesses. The Adminis- 
trative Office of the 
Courts has contracts 
with some private 
agencies giving them 
access to the state 
database and 
allowing them to 
resell the records. The 
records can be 
purchased by anyone 
and are available on 
the Internet.*” The 
Administrative Office 
of the Courts retains 
the funds generated 
by these contracts to 
support its technology programs.*° 


Juror Privacy Issues 


Jurors are a vital part of the court sys- 
tem. Although relatively few cases are 
disposed of by jury trials, the fact that a 
jury is available is very important. All 
participants in civil settlement or crimi- 
nal plea negotiations consider what a 
jury would do in making judgments about 
the reasonableness of an offer from the 


other side. In a real sense, juries deter- 
mine what justice means in a community. 

Jurors are not paid well, are forced 
to miss work, and in many instances do 
not have particularly good physical 
surroundings in which to do their job.*! 
Nevertheless, every year, tens of 
thousands of citizens report to court- 
houses for jury service, most of them 
cheerfully. As they begin their service, 
tension between their desire for privacy 
and the need for open information 
about the courts once again arises. As is 
true in other contexts, the privacy 
interest rarely prevails. 

The issue can come up in a variety of 
contexts. In rare, high-profile cases, a 
juror’s lifestyle may be investigated 
before he or she reports for jury service. 
When the juror reports for duty and is 
questioned about his or her fitness to 
serve, the questioning (called voir dire) 
often delves into personal matters as 
attorneys determine if potential jurors 
have fixed opinions on issues important 
to the case. If a juror completes a 
questionnaire with personal information, 
he or she may be concerned about the 
retention of that document. If a trial is 
highly publicized, a juror may be the 
subject of publicity. Also, to protect 
either their privacy or their safety, jurors 
may have concerns about the parties to 
the case knowing their address. 

Data are available on how North 
Carolina jurors feel about some of those 
issues. In a recent survey, 43 percent of 
North Carolina jurors responding felt 
that voir dire questions were unnecessary, 
27 percent said the questions made 
them uncomfortable, and 27 percent 
considered the questions invasions of 
their privacy. One of the most frequently 
raised concerns was the embarrassment 
of having to discuss prior criminal 
convictions publicly. Further, 25 percent 
of those surveyed felt that unnecessary 
questions were asked about their 
families, their employment, their church 
affiliation, and like matters. 

Jurors’ main concern was that such 
questions often had the effect of 
stereotyping them based on where they 
lived, worked, or worshipped. Of those 
asked about their religion, 20 percent 
thought the questions were irrelevant 
and intrusive. 

In general, the survey found that 





jurors’ interests in privacy had several 
components. Jurors wanted to limit 
public disclosure of sensitive or 
embarrassing 
information. They did 
not want the 
questions to cause 
them to have 
concerns about their 
personal safety. Also, 
they wanted the 
questioning to 
minimize the 
possibility of their 
being stereoty ped. ws 

If protecting 
jurors’ privacy was 
the dominant value in 
the judicial system, 
the practices just 
mentioned would not 
be permitted. The 
system exists, how- 
ever, to provide 
parties with a fair 
trial, in which they , 
are judged by their dire process.” 
peers and not by an 
agent of the government. That system 
has costs, and one of them is some loss 
of a juror’s interest in his or her privacy. 

Within that framework, though, 
jurors have limited protections. The 
American Bar Association’s standard, 

a benchmark against which courts 
measure their systems, provides that 
“the Judge should ensure that the pri- 
vacy of prospective jurors is reasonably 
protected and that questioning is con- 
sistent with the purpose of the voir dire 
process. ”* 

In North Carolina, some statutes and 
policies help serve that interest. First, 
the master jury list for each county is 
available for public inspection, but it 
does not list jurors in the order in which 
they will be summoned.* This makes it 
less likely that potential jurors will be 
the subject of an investigation before 
being called to serve.*° 

Second, in instances in which 
material is appropriate for voir dire 
questioning but is nonetheless 
embarrassing or highly sensitive, the 
U.S. Supreme Court has approved the 
closing of the courtroom to the public 
during jury selection. The Court 
allowed the closing when the process 


The American Bar Association's 
standard, a benchmark against 
which courts measure their 
systems, provides that “the 
Judge should ensure that the 
privacy of prospective jurors 

is reasonably protected and 
that questioning is consistent 
with the purpose of the voir 


involved questions that “touch on 

deeply personal matters that the person 

has legitimate reasons for keeping out 
of the public 
domain.” To close the 
court in those 
instances, the Court 
directed trial judges to 


maintain control of .. . 
jury selection and [to] 
inform the array of 
prospective jurors, 
once the general 
nature of sensitive 
questions is made 
known to them, that 
those individuals 
believing that public 
questioning will prove 
damaging because of 
embarrassment, may 
properly request an 
opportunity to pre- 
sent the problem to 
the judge in camera 
[in private], but with 
the counsel present 


and on the record.* 


Finally, judges may limit the scope 
of questions allowed in voir dire to 
prevent questioning on inappropriate 
matters. In the case establishing that 
authority most clearly, the trial judge 
prohibited the defense attorney in a 
death-penalty case from inquiring into 
a juror’s religious denomination or 
participation in church activities: “Even 
though the state and the defendant are 
entitled to inquire into a prospective 
juror’s beliefs and attitudes, neither has 
the right to delve without restraint into 


all matters concerning potential jurors’ 


private lives.”* 


Conclusion 


The job of courts is to balance interests 
to determine just results in specific 
cases. They also must strike the right 
balance when privacy interests conflict 
with other important interests, such as 
the public’s right of access to its courts 
or a party’s right to a fair trial. In most 
cases the privacy interest, although 
important, does not prevail because, in 
a democratic society, having a justice 
system in which citizens have confi- 


dence is so important that citizens are 
willing to give up some of their privacy. 
The balance has changed over the years 
and will continue to do so, but the goal 
is likely to remain the same: to keep the 
courts as a public institution that has 
the confidence of the public and does 
not unduly invade the privacy of those 
who use it. 
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Employee Privacy and Workplace Searches 


Stephen Allred 


ublic employers routinely furnish 

employees with offices, desks, 

file cabinets, lockers, computers, 
and other items with which to perform 
their jobs. Even though the employer 
pays for these items, the employees who 
use them take on a sense of ownership 
—and privacy—in their workspaces. 
Indeed, given the amount of time people 
spend at the workplace these days, 
the office often becomes a home away 
from home, complete with pictures of 
the family, souvenirs from trips, and a 
large collection of coffee cups. 

But what happens when a public 
employer has reason to suspect that an 
employee has engaged in inappropriate 
activity, and the employer wants to 
search the employee’s workplace? May 
a supervisor root around in an employee’s 
desk in hopes of finding proof of 
misconduct? May an employer search 
an employee’s computer, even if it is 
password protected? Many do so, 
according to a recent survey conducted 
by the Society for Human Resource 
Management.! Sixty-two percent of 
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responding employers said that they 
sometimes monitored Internet use, 

58 percent e-mail, and 42 percent 
telephone calls. This article explores the 
current state of the law on employee 
privacy and workplace searches. The 
discussion pertains strictly to public 
employers and employees. Generally 
the law does not protect private-sector 
employees from workplace searches by 


their employers. 


High Court Recognition of 
Public Employee Privacy Interest 


For the Fourth Amendment to protect 
any individual from government 
searches, the government must cross a 
judicially constructed threshold. In Katz 
v. United States, the U.S. Supreme Court 
held that Fourth Amendment protec- 
tions are triggered only if a person has a 
reasonable expectation of privacy.’ 

For this standard to be met, the 
person must have “an actual or subjec- 
tive expectation of privacy” in the area 
or the things to be searched and this 


expectation must “be one that s« ciety 1S 
prepared to recognize as ‘reasonable.’” 
If a person does not have an expectation 
of privacy that is recognized as 
reasonable, the Fourth Amendment is 
not triggered, and the government may 
search at will. It may search without a 
warrant and even without the most 
rudimentary showing of “reasonable 
suspicion” —that is, grounds to believe 
that the person has engaged in illegal or 
inappropriate conduct. (For a fuller 
discussion of Katz and the requirements 
of the Fourth Amendment, see the 


3.) 


article on page 1. 
The notion that public employees 
may have a protected privacy interest in 

their workplace is a relatively recent 
development in the law. In 1987, for the 
first time, the U.S. Supreme Court 
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considered whether the Fourth Amend- 
ment protected public employees 

from searches of their workplaces. In 
O’Connor v. Ortega, a physician who 
worked in a state hospital was suspected 
of various acts of misconduct, including 
theft of hospital property and sexual 
harassment.* The executive director of 
the hospital suspended the physician 
pending completion of an investigation 
into the alleged misconduct. As part of 
that investigation, the executive director 
and other management officials entered 
the physician’s office and searched his 
file cabinets and desk. Certain materials 
found in that search were used in the 
subsequent administrative proceeding to 
remove the physician. 

The physician maintained that the 
search of his office by hospital officials 
violated the Fourth Amendment’s 
prohibition against unreasonable 
searches. The Court, in a 5-4 ruling, 
held that searches of government offices 
by government employers are subject 
to Fourth Amendment constraints. 

The Court first held that the 
physician had a reasonable expectation 
of privacy in his office, including his 
desk and file cabinets. The Court then 
considered the standard for judging 
whether a search of the physician’s 
office was reasonable, holding that “the 
invasion of the employee’s legitimate 
expectations of privacy” must be 
balanced against “the government’s 
need for supervision, control, and the 
efficient operation of the workplace.” 
The Court held that the reasonableness 
of a search had to be determined on a 
case-by-case basis. In the O’Connor 
case, the Court declined to rule on 
whether the search of the physician’s 
office had been reasonable because 
there were unresolved issues of fact for 
the lower court to consider. 

O’Connor thus established that if a 


public employee has a reasonable 


expectation of privacy in the area or the 


things to be searched, a search by an 
employer is constitutional only if the 
interests of the employer in maintaining 
a safe and efficient workplace override 
the privacy interests of the employee. 
(This standard is less onerous than that 


applied to searches by law enforcement 


officers, discussed in the article on page 
13.) O’Connor left to the lower courts 
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the task of striking the appropriate 
balance in each case by assessing the 
reasonableness of the employee’s expec- 
tation of privacy and the reasonableness 
of the employer’s search in light of the 
employee’s privacy interest. The courts’ 
application of this standard in different 
situations is reviewed in the following 


sections. 


Lower Court Rulings 


There have been surprisingly few cases 
in which the lower courts have applied 
the O’Connor standard, but there have 
been a sufficient number for a pattern to 
emerge. 

In Showengerdt v. General Dynamics 
Corporation, the court reviewed the 
dismissal of a federal employee for 
possession of pornographic materials at 
the workplace.® The materials in 
question were kept in the employee’s 
locked desk in his locked office but were 
seized by his supervisor and a security 
officer. The court found that the 
employee had a reasonable expectation 
of privacy in his locked desk and office 
—the first inquiry required under 
O’Connor—but remanded the case for 
a determination of whether the govern- 
ment’s purpose in investigating work- 
related misconduct outweighed the 
employee’s Fourth Amendment privacy 
interest—the second O’Connor inquiry. 

In a similar case, Gossmeyer v. 
McDonald, a child protective investiga- 
tor’s rights were held not to have been 
violated when her employer, with the 
assistance of law enforcement officials, 
conducted a warrantless search of her 
desk, file cabinet, and storage unit 
based on a co-worker’s tip that she had 
pornographic pictures of children in her 
office.” Assessing the second O’Connor 
requirement, the court held that the 
search was reasonable. It found that the 
search was based on a tip by a co- 
worker, which was sufficiently reliable 
in that it specifically alleged where the 
pictures would be found; and that the 
search was reasonable in scope in that it 
was limited to places where the pictures 
were stored. 

In Diaz Camacho v. Lopez Rivera, 
the court considered a claim by a 
dismissed fire chief that his Fourth 
Amendment rights had been violated 


when his employer had conducted a 
search of his office.* The court upheld 
the search and sustained the employee’s 
dismissal, finding that the town officials 
had reasonable grounds to suspect that 
the fire chief was guilty of work-related 
misconduct and that a search of his 
office might turn up evidence of such 
misconduct. In so ruling, the court 
noted that the chief’s office also was 
used to store the fire station’s official 
records and maintenance equipment, 
thus creating a lower expectation of 
privacy than might otherwise have been 
the case and affecting the balance to be 
struck in weighing the employer’s 
interests against the employee’s. 

In Williams v. Philadelphia Housing 
Authority, a supervisor’s removal of her 
subordinate employee’s computer disk 
from his desk was upheld.’ The 
employee was on a leave of absence and 
had been asked to clear his desk. 
Because the supervisor initiated the 
search to look for work-related material, 
the court found her search to be 
reasonable. By contrast, in Rossi v. 
Town of Pelham, the court held that a 
town police officer’s search of the town 
clerk’s office for certain municipal 
records was unreasonable.'® The court 
held that the clerk enjoyed an expecta- 
tion of privacy in her office because she 
had exclusive access to and use of the 
area and the town had not placed her 
on notice that the office was subject to 
intrusions by other town officials. 

In Johnson v. City of Menlo Park, a 
municipal employee was fired after a 
co-worker complained that he had 
sexually harassed her.'' Eventually, an 
arbitrator ordered the employee 
reinstated and awarded back pay. The 
employee also sued the city, claiming 
that his Fourth Amendment rights were 
violated when his employer searched his 
desk in investigating the sexual harass- 
ment charge. The city had a written 
policy stating that the city reserved the 
right to open, inspect, and examine all 
equipment and workspaces at any time 
for legitimate business reasons, 
including investigating work-related 
misconduct. The court held that because 
the policy was known to the employee 
and made it clear that the city had the 
right to search the workplace, the 
employee did not have a reasonable 





expectation of privacy in his desk. The 
court therefore granted summary 
judgment for the employer. 

In United States v. Chandler, in 
which a municipal police officer left his 
duty bag in his locker after he was 
suspended, the court 
found that he had no 
reasonable expecta- 
tion of privacy. 

Che internal affairs 
division retrieved the 
bag and conducted a 
warrantless search 
that yielded crack 
cocaine and heroin. 
The court held that the 
search did not violate 
the employee’s Fourth 
Amendment rights 
because the bag was 
abandoned property. 
Thus any expectation 
of privacy was for 
feited. 

In United States v. 
Simons, the court 
considered a computer 
case in which the 
plaintiff worked for the Central 
Intelligence Agency (CIA).'? He had his 
own computer in his office, which he 
did not share with anyone. The CIA had 
a policy authorizing electronic audits to 
ensure that unlawful material was not 
downloaded onto government com- 
puters. The policy explained, in detail, 
how the auditing program worked. 

The program included looking at sent 
and received e-mails, Web-site visits, 
and the like. The policy also stated that 
the agency would periodically audit, 
inspect, and monitor the employee’s 
Internet access. 

One of the employer’s computer 
programmers entered the word “sex” in 
a search and found that the plaintiff had 
a large number of hits. From his own 
computer, the programmer examined 
the hard drive of the employee’s 
computer and found more than 1,000 
pornographic images, some of minors. 
Subsequently a manager physically 
entered the employee’s office and 
removed the hard drive. Later searches, 
with warrants, were conducted, and 
other evidence was found. The Fourth 
Circuit Court of Appeals held that the 


The court held that because 
the policy was known to 

the employee and made it 
clear that the city had the 
right to search the workplace, 
the employee did not have a 
reasonable expectation of 
privacy in his desk. 


remote searches of the employee’s 
computer did not violate his Fourth 
Amendment rights because, in light of 
the policy, he lacked a legitimate expec- 
tation of privacy in the files downloaded 
from the Internet. For the same reasons, 
the employee’s Fourth 
Amendment rights 
were not violated by 
the retrieval of his 
hard drive from his 
office. In addressing 
the actual entry into 
the employee’s office, 
the court held that 
the employ ee did 
have a reasonable 
expectation of 
privacy, but the entry 
was lawful because 
the CIA had reason- 
able grounds for sus- 
pecting that the entry 
would yield evidence 
of misconduct. 
Finally, in Leven- 
thal v. Knapek, the 
court heard a claim 
by an accountant in a 
state department of transportation." 
His supervisors received an anonymous 
letter that did not name him but gave 
his pay grade, gender, and job title. He 
was the only one at his pay grade in his 
office. The letter accused him of being 
late, being gone from the office half the 
time, doing primarily nonoffice work 
when he was there, and always talking 


to co-workers about personal computers. 


As a result of the letter, the supervisors 
conducted a computer review without 
his knowledge and found tax prepara- 
tion programs that the employee was 
using for his private tax business. The 
employee was suspended without pay 
for thirty days but then challenged the 
right of the employer to search his 
computer. 

The Second Circuit Court of Appeals 
ruled that the search did not violate 
the employee’s Fourth Amendment 
rights. The employee had a reasonable 
expectation of priv acy in the contents 
of his computer, the court held, but the 
search was reasonably related to the 
department’s investigation into alle- 
gations of the employee’s workplace 
misconduct. 


Lessons Learned 


One lesson that emerges from these 
cases is that it may be difficult for a 
public employee to assert an overriding 
privacy interest if his or her employer 
has developed and posted a policy 
informing employees that the workplace 
is subject to periodic searches. 

A second lesson, though, is that even 
if the employee can assert a reasonable 
expectation of privacy, the public em- 
ployer can meet the burden of showing 
the reasonableness of the search on the 
basis of a combination of factors—for 
example, (1) a tip by a credible co- 
worker of misconduct (Gossmeyer and 
Leventhal); (2) the limited scope of the 
search (Gossmeyer); (3) a lowered expec- 
tation of privacy because of accessibility 
(Diaz Camacho); and (4) the limited 
purpose of the search ( Williams). 

The final lesson of these cases is that 
before conducting a workplace search of 
employees’ lockers, offices, files, or other 
areas in which employees may fairly 
be said to have a legitimate expectation 
of privacy, employers should consider 
whether the need for supervision, control, 
and efficient operation of the facility out- 


weighs the employees’ privacy interest. 
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Privacy and Public School Students 


ince September 11, 2001, many 

public institutions have been 

trying to strike the proper balance 
between security and privacy. In public 
schools, striking that balance has been 
the subject of intense debate, extensive 
policy making, and lawsuits for years. 
Public school students, and adults, have 
the same concerns about privacy. They 
want control over who searches their 
possessions and their bodies and who 
has access to information about them. 

Students and their parents who think 

school officials have acted in a way that 
does not properly respect students’ 
privacy may challenge the action. Occa- 
sionally the challenge results in litiga- 
tion. The U.S. Supreme Court hears 
only a small fraction of the cases it is 
asked to review, so its decision to hear 
three cases involving student privacy in 
its 2001-2 term is noteworthy. This 
article provides a brief overview of the 
two issues before the Court: searches of 


students and student records. 


Searches of Students 


As concerns about discipline, drugs, 
and violence at schools have increased, 
so have school officials’ need and desire 
for authority to search students and 
their belongings. At the same time, 
schools must respect students’ rights, 
including their right to privacy. 
Everyone wants safe and orderly 
schools.? Schools are special places, 
with a special mission,’ and students, 
in part because of their youth, need 
protection. The Constitution guarantees 
students constitutional rights, even 
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though schools might be safer and more 
orderly if it did not.* However, when 
students are at school or are involved 

in school activities, their rights often 
are more limited than if they were else- 
where.’ This certainly is true when the 
issue is a student’s 
right under the Fourth 
Amendment to the 
U.S. Constitution to 
be free from unrea- 
sonable searches of 
his or her person or 
property. 

In 1985, in New 
Jersey v. T.L.O., the 
U.S. Supreme Court 
for the first time 
stated directly that the 
Fourth Amendment 
applies to schools and 
that students’ legiti- 
mate expectations of 
privacy must be bal- 
anced against schools’ 
need to maintain a 
safe environment for 
teaching and 
learning.® In that case 
the Court established the standard for 


searches of students by school officials: 


¢ The Fourth Amendment’s prohibi- 
tion of “unreasonable searches” 
applies to searches of public school 
students conducted by school 
officials. The legality of a search of a 
student depends on the reasonable- 
ness, under all the circumstances, of 
the search. 
School officials do not need a search 
warrant to search a student under 
their control. 
School officials need “reasonable sus- 
picion” to search a student. Reason- 
able suspicion is a less demanding 


As concerns about discipline, 
drugs, and violence at schools 
have increased, so have school 
officials’ need and desire for 
authority to search students 
and their belongings. 
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standard than probable cause (the 
standard generally applied in 
assessing the lawfulness of a search 
as part of a criminal investigation). 
e Students have a reasonable 
expectation of privacy in personal 
articles carried inside 
their purses, wallets, 
and book bags, as 
well as in their 
clothing and on their 
bodies.® 
e If a student gives a 
valid consent to a 
search, schools of- 
ficials may proceed 
with or without 
“e reasonable suspi- 
cion. However, a 
student’s consent 
may be subject to 
claims that the stu- 
dent did not under- 
stand what he or she 
was consenting to or 
that the consent was 
not voluntary. 
¢ In situations in 
which a student has 
no legitimate expectation of privacy, the 
Fourth Amendment does not restrict 


searches by school officials. 


Elements of a Reasonable Search 
[.L.O, set out a two-part test to 
determine whether a search by school 
officials is reasonable under the Fourth 
Amendment. The first part of the test 
requires that a search be reasonable at 
its inception. This condition is met if 
school officials have reasonable sus- 
picion that the search will uncover 
evidence that the student has violated or 
is violating either a law or a school rule. 
Reasonable suspicion may be based on 
personal observation or information 





from others. Courts evaluating whether 
reasonable suspicion existed at the time 
of the search have considered the 
reliability of the information and of its 
source; the need to conduct an imme- 
diate search without additional infor- 
mation; the nature of the violation of a 
law or a school rule; and information 
that the school already had about the 
problem and the individual student. 


vi és 
The U.S. Supreme Court will 
soon rule on whether a school 
may conduct random, suspicionless 
drug testing of students 
in marching bandsand other 
extracurricular activities. 


In reaching their conclusion about 


the presence of reasonable suspicion, 
school officials are entitled to rely on 


“common-sense conclusions about 
human behavior.”’ The results of the 
search do not affect its reasonableness 


at inception. That is, positive results do 
not turn an unreasonable search into a 
reasonable one. 

Che second part of the T.L.O. test 
requires that the scope of the search be 
reasonably related to the circumstances 
that justified it. This means that a 
search must be reasonably related to its 
objectives and not excessively intrusive 


in light of the age and the sex of the 


student and the nature of the infraction. 
This requirement is the basis for many 
rulings finding strip searches for missing 
property unconstitutional.'° Strip searches 
for illegal drugs, however, have more 
often been upheld when grounds to 
search have existed.'! 


Application of the T.L.O. Standard in 
North Carolina 

The North Carolina Court of Appeals 
has decided two student search cases. ' 
Neither case breaks new legal ground. 
In each case a student raised the issue of 


the involvement of “school resource 
officers” (law enforcement officers 
working regularly in public schools) in 
the search—a fact not present in T.L.O. 
However, the court did not find it neces- 
sary to decide whether resource officers 
act as law enforcement officers subject 
to the warrant and probable-cause 
requirements of the Fourth Amendment 
or act as school officials subject to the 
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less demanding reasonable-suspicion 
standard established in T.L.O. 

In the first case, an assistant principal 
found a pellet gun in a student’s book 
bag, and, as a result, the student was 
adjudicated delinquent for possessing a 
weapon on school property.'* The stu- 
dent wanted the evidence suppressed 
and challenged the constitutionality of 
the search because of the school resource 
officer’s actions, which included hand- 
cuffing him. The court found that the 
assistant principal, acting on an un- 
solicited tip followed by the student’s 
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THE EARLS CASE: DRUG TESTING OF PARTICIPANTS 
IN EXTRACURRICULAR ACTIVITIES 


In Earls v. Board of Education of Tecumseh Public School District No. 92 of 
Pottawatomie County, a school district policy made high school students’ 
participation in any extracurricular activities contingent on their consenting to 
random, suspicionless drug testing. All students choosing to participate were 
required to take an initial drug test and to agree to periodic random, 
suspicionless testing (as well as testing if the school had individualized 
suspicion). Several students sued the district over the policy's application to 
members of the show choir, the marching band, and the academic team. (The 
drug testing of athletes was not challenged.) 

The federal district court ruled in favor of the school board, but the Tenth 
Circuit Court of Appeals reversed the decision, finding that the board did not 
have sufficient justification for the policy. The court applied the factors that the 
Supreme Court used in Vernonia: the students’ expectation of privacy, the 
character of the intrusion, the nature and the immediacy of the governmental 
concern, and the efficacy of the solution. Looking at the first two factors, the 
court found that participants in extracurricular activities have a somewhat lesser 
expectation of privacy than nonparticipants and that the invasion of privacy 
was not significant, given the manner in which the drug tests were conducted. 

However, looking at the third factor, the court found in favor of the students. 
Given the paucity of evidence of an actual drug abuse problem, the immediacy 
of the district's concern was greatly diminished, as was the efficacy of the 
district's solution. The court saw “little efficacy in a drug testing policy which 
tests students among whom there is no measurable drug problem.” The court 
explained that “any district seeking to impose a random suspicionless drug- 
testing policy as a condition of participation in a school activity must demonstrate 
that there is some identifiable drug abuse problem among a sufficient number of 
those subject to the testing, such that testing will actually redress the problem.” 

The school board stopped the testing and appealed to the Supreme Court 


The Court agreed to hear the case during its 2001-2 term. 


Note 


1. Earls v. Board of Educ. of Tecumseh Public Sch. Dist. No. 92 of Pottawatomie County 
242 F.3d 1264, 1277, 1278 (10th Cir.), cert. granted, 122 S. Ct. 509 (Nov. 8, 2001) 


uncooperative and disruptive behavior 
when approached, had reasonable cause 
to search his book bag. While the search 
was in progress, the assistant principal 
asked the resource officer to help con- 
trol the student. The court found that 
the officer was involved solely to allow 
the assistant principal to search the book 
bag without interference or danger. The 
’.L.O. standard was satisfied because a 
school official conducted the search and 
had reasonable grounds to do so. 

In the second case, after a student 
was found in possession of a knife on 
public school grounds, she was 
adjudicated delinquent and placed on 
supervised probation.'* She appealed, 
claiming that the knife was obtained 


38 POPULAR GOVERNMENT 


through an unreasonable search. The 
principal had received information from 
a substitute teacher that students from 
another school were planning to come 
onto the campus to fight and that a 


student at the school would be involved. 


On the basis of his experience, the prin- 
cipal was concerned that the intruding 
students would have weapons. He, the 
school resource officer, and two off-duty 
law enforcement officers confronted 
the four students, all girls. The girls 


responded to the principal evasively and 


with profanity and gave false names. 
Shortly after their behavior and 
responses to his questions heightened 
the principal’s suspicions, the resource 
officer searched D.D.’s purse. 


The student argued that the T.L.O. 
standard should not apply because she 
was not enrolled in that school and 
because law enforcement officers par- 
ticipated in the investigation and the 
search. The court concluded that, despite 
the student’s not being enrolled in the 
school, the T.L.O. standard was appro- 
priate. The law enforcement officers’ 
involvement was minimal relative to the 
principal’s. At most they acted “in con- 
junction with” the principal to further 
his obligations to maintain a safe, 
educational environment and to report 
truants from other schools. 


Searches without 

Individualized Suspicion 

T.L.O. and many lower court cases have 
answered many questions regarding 
whether school officials have had 
reasonable suspicion that a search of a 
particular student or a specific, 
identifiable group of students would 
turn up evidence of a violation of a 
law or a school rule. However, one of 
the major questions T.L.O. left 
unresolved is the reasonableness of 
searches when school officials believe 
that a law or a school rule is being 
violated but do not have reasonable 
suspicion about a particular student or 
group of students. Suppose, for 
example, that school officials have 
reliable evidence that drug use among 
students, especially athletes, is 
increasingly a problem. These school 
officials have a legitimate concern, but 
they do not have “individualized 
suspicion” about specific students. 

In settings other than schools, the 
U.S. Supreme Court has held that a 
search may be conducted without 
individualized suspicion when “the 
privacy interests implicated by the 
search are minimal, and . . . an impor- 
tant governmental interest furthered by 
the intrusion would be placed in jeo- 
pardy by a requirement of individu- 
alized suspicion.” '’ In T.L.O. itself the 
Court indicated that exceptions to the 
need for individualized suspicion could 
be made when 


the privacy interests implicated by 
a search are minimal and where 
“other safeguards” are available 
“to assure that the individual’s 





reasonable expectation of privacy 
is not ‘subject to the discretion of 
the official in the field.’”' 


In Vernonia School District 47] v. 
Acton, the only student search case 
decided by the Court since T.L.O., the 
Court addressed the issue of mandatory 
random drug-testing of students 
participating in athletics.'’ In reaction to 
an increase in drug use by high school 
students, especially among athletes, a 
school district in Oregon established a 
mandatory urinalysis drug-testing 
program. Students had to consent to the 
tests as a prerequisite to participating in 
high school athletics. A student who 
wanted to play football refused to con- 
sent and then sued the school district, 
claiming that the mandatory search 
violated the Fourth Amendment. 

The Court ruled that the search 
was reasonable and therefore constitu- 
tional. Reasonableness is determined by 
balancing the intrusion into the 
individual’s privacy interest against the 
search’s promotion of a legitimate 
government interest. The Court con- 
sidered three factors: (1) the nature of 


the privacy interest, (2) the character of 


the intrusion, and (3) the nature and the 


immediacy of the government interest, 
and the efficacy of the search as a means 
of meeting that interest. The Court 
ruled that deterring drug use among 
athletes justified the policy, in light of 
the district’s evidence that a problem 
existed, the athletes’ lowered expec- 
tation of privacy inherent in participa- 
tion in sports, and the minimal intrusion 
on student privacy because of the 
manner in which the drug tests were 
conducted. 

The Court did not rule on the issue 
of random, suspicionless drug testing of 
all students or even of students partici- 
pating in extracurricular activities 
besides athletics.'* Challenges to school 
policies involving suspicionless testing 
since Vernonia have had mixed results; 
courts have decided in favor of students 
in some cases and in favor of school 
officials in others.'” 

A clearer picture of the constitu- 
tionality of these searches should soon 
emerge. The U.S. Supreme Court has 
agreed to hear Earls v. Board of Edu- 
cation of Tecumseh Public School Dis- 
trict No. 92 of Pottawatomie County,”° 
and its decision will clarify the scope of 
Vernonia. (For the details of the Earls 
case, see the sidebar, opposite.) 


Many schools 
have policies 
that permit 
school officials 
to search stu- 
dent lockers at 
any time, with 
or without 
reasonable 
suspicion. Such 
policies are 
assumed to 
eliminate any 
expectation of 
privacy ina 
locker. No 
North Carolina 
court has ruled 
on the constitu- 
tionality of this 
type of policy. 


Student Records 


A second issue involving student privacy 
arises inevitably in schools. Schools 
gather and maintain a wealth of infor- 
mation about the students whom they 
enroll: academic performance, health, 
race, family, disciplinary actions, 
attendance, extracurricular activities, 
socioeconomic status, and involvement 
with the department of social services 
and law enforcement agencies. 

Not surprisingly, school officials 
frequently find themselves balancing the 
need to disclose information about an 
individual student against the student’s 
interest in keeping the information 
confidential. In this balancing, school 
officials’ choices are guided by the 
federal Family Educational Rights and 
Privacy Act of 1974, commonly known 
as FERPA or the Buckley Amendment.?! 
FERPA applies to all public schools in 
North Carolina and to the State Depar- 
tment of Public Instruction because 
these entities receive federal funds. 

FERPA resolves many issues related 
to confidentiality of student records. 
This statute was enacted nearly thirty 
years ago for two purposes.” First, 
FERPA ensures that parents, those 
acting as parents, and students once 
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they turn eighteen have access to the 
information that a school or a state 
education agency maintains about a 
student.*’ Second, FERPA protects stu- 
dents’ privacy by prohibiting disclosure 
of information about them without 
parental consent except in situations in 
which Congress has decided that the 
benefits of disclosure outweigh the 
benefits of confidentiality. Sometimes 
the need to share information is 
obvious, as in a medical emergency or 
when a child enrolls in a new school. At 
other times, such as for certain educa- 
tional research projects, the benefit is 
less direct but nonetheless real. 

FERPA does not control access to all 
information that school employees have 
about students. It controls access only 
to “education records,” those records 
that are directly related to a student and 
maintained by an education agency or 


institution or by a person acting for the 


agency or the institution.?* It makes no 
difference whether the information is 
located in the student’s official record, 
in the special education office, or in the 
central office. 

By contrast, observations that a 
school employee makes about a student 
but does not record are not education 
records. Also, records that instructional, 
supervisory, and administrative person- 
nel make and keep for themselves as 
memory aids (known as “sole possession 
notes”) are not education records if they 


are not available to anyone other than a 


temporary substitute for the record 


maker. 
FERPA establishes several basic 


rights for parents: 


e Parents have the right to be informed 
about their rights under FERPA. 
e Parents may inspect and review their 


child’s education records but only 


records with information about their 
child. 

Parents may request that a school 
change the information in their 
child’s records if they believe that the 
information is inaccurate or 
misleading or otherwise in violation 
of the child’s privacy rights. Parents 
have the right to a hearing to chal- 
lenge the contents of the education 
records. They also have the right to 
place their own statement in the 
child’s records explaining their view 
about the contested information. 
This statement must accompany the 
contested information if it is dis- 
closed to anyone. 

Parents have the right to control the 
disclosure of the information in their 
child’s education records unless a 
specific exception allows the school 
to disclose information without the 


parent’s consent. 


FERPA CASES BEFORE THE U.S. SUPREME COURT 


The Gonzaga University Case: individual Lawsuits 

for Damages 

A former student, John Doe, sued Gonzaga University 
(Spokane, Washington) for violating his rights under 
FERPA, along with other claims. Doe argued that Gonzaga 
had disclosed confidential information about him, without 
his consent, to the Office of the Superintendent of Public 
Instruction, the Washington state agency that certifies 
teachers. Doe charged that university officials had ruined 
his chances for a teaching career by telling the agency that 
he allegedly had raped another student. A jury agreed and 
awarded Doe $150,000 in damages for the FERPA 
violation, along with damages for other claims. The state 
court of appeals reversed the jury award.' Doe appealed to 
the state supreme court. 

One issue facing the court was whether individuals can 
sue for damages for FERPA violations. Several courts have 
held that FERPA itself does not give rise to a private cause 
of action.? However, Doe used the FERPA violation as the 
basis for a claim under a federal civil rights statute that 
provides a remedy for federally conferred rights. The act is 
popularly known as Section 1983 for its location in the 
United States Code. The state supreme court ruled that 
FERPA does give rise to a federal right enforceable under 
Section 1983.* The U.S. Supreme Court has agreed to 
review this decision.® 


The Fa/lvo Case: The Meaning of “Education Records” 
On November 27, 2001, the U.S. Supreme Court heard a 
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case, Owasso Independent Schoo! District v. Falvo, dealing 
with a FERPA issue so basic that its not having been resolved 
long ago is surprising. The issue is the meaning of the term 
“education records.” Specifically the issue is whether, in 
the absence of parental consent, allowing students to 
grade one another's homework and tests as their teacher 
goes over the correct answers aloud in class violates FERPA’s 
prohibition against the release of education records. 

Kristja Falvo's children attended public school in 
Oklahoma. Some of their teachers had them exchange 
papers and grade one another's work. When students got 
their own papers back, they called out their grades to the 
teacher. Falvo complained to the school counselors and 
the superintendent that this practice embarrassed her 
children. Although the school offered the children the 
option of confidentially reporting their grades to the 
teacher, the school district was not willing to issue a flat 
ban on students’ trading papers. Falvo sued the district, 
claiming that the practice violated both the privacy rights 
implicit in the Fourteenth Amendment and FERPA. 

The district court found no violation of either the Fourth 
Amendment or FERPA. Falvo appealed. The Tenth Circuit 
Court of Appeals found no violation of the Fourth 
Amendment but ruled that allowing students to grade 
one another's papers, even without calling out grades to 
the teacher, violates FERPA by allowing the disclosure of 
education records without parental consent.® (Remember 
that FERPA defines “education records” as records that 
contain information directly related to a student and that 





¢ Parents have the right to complain 
to the FERPA Office in the federal 
Department of Education if they be- 
lieve the school has violated FERPA. 


Schools must respect these rights and 
fulfill corresponding responsibilities. 
First, schools must notify parents annually 
of their rights under FERPA. Further, 
schools must maintain a record showing 
all organizations, agencies, and individuals 
(except school officials and employees) 
that have requested or obtained access 
to a student’s education records and 
indicating the legitimate interest each 
had in obtaining the information. 

Most important, school officials must 
have specific written consent from a 
student’s parent before disclosing 
personally identifiable information in 
that student’s education records (or 
before giving access to the records them- 


selves) unless disclosure is made under 


one of the exceptions in FERPA.”¢ The 
most significant exceptions are as 


follows: 


¢ Disclosure to other school officials, 
including teachers, with a legitimate 
educational interest. For example, a 
teacher who is having problems with 
a student may look at the student’s 
records to learn whether the problem 
is new or has been addressed pre- 
viously. A teacher who is merely 
curious about a student’s academic 
performance or disability status, how- 
ever, has no legitimate educational 
interest and should not have access 
to the records. 
Disclosure in connection with an 
emergency if information is necessary 
to protect the health or safety of the 
student or other people. 
Disclosure to another school or 
school system in which the student 


seeks or intends to enroll. The 
student’s parents must be notified of 
the disclosure and receive a copy of 
the records that were sent to the 
enrolling school if they want a copy. 
Disclosure in response to a judicial 
order or pursuant to a lawfully 
issued subpoena.?* A school must 
make reasonable efforts to notify the 
parents in advance of disclosing the 
information. 

Disclosure to state and local officials 
in connection with the state’s juvenile 
justice system, under specific 
conditions. 

Disclosure to organizations con- 
ducting studies for, or on behalf of, 
education agencies or institutions for 
the purpose of developing, valida- 
ting, or administering predictive 
tests, administering student aid pro 
grams, Or improving instruction, 


with conditions. 


are maintained by an education agency or institution or by 
a person acting for the agency or the institution.) The court 


explained that when one student puts a grade on another 
student's paper at the teacher's direction, and then the 
teacher records at least some of the grades for his or her 
use (as the teacher did), the first student is acting “for the 
school district.” The school board appealed, arguing that 
student work that is created, used, or kept in the classroom 
and not made part of a student's institutional record does 
not meet the definition of education record. 

The U.S. Supreme Court announced its decision in 
February 2002. In a 9-0 ruling, it reversed the decision of 
the court of appeals, holding that peer grading does not 
violate FERPA.’ The Court explained that student papers in 
the hands of other students for grading are not education 
records. The papers do not meet the statutory definition 
because they are not records “maintained” by the school, 
nor are the students “acting for” the school. In addition, 
the Court noted that under the court of appeals’ interpre- 
tation of FERPA, the federal government would become 
more involved in specific teaching methods and instruc- 
tional dynamics in classrooms than Congress is likely to 
have mandated 

The holding in the case is limited to the narrow point 
that, assuming a teacher's grade book is an education 
record, grades on students’ papers are not covered by 
FERPA before the teacher has recorded them. The Court did 
not decide whether grades on individual assignments are 


education records once the teacher has recorded them. 
However, it did say that FERPA “implied” that education 
records are institutional records kept by a single central 
custodian, such as a registrar. Justice Antonin Scalia, though 
concurring in the judgment, disagreed with that view. 


Notes 


1. Doe v. Gonzaga Univ., 992 P.2d 545 (Wash. App. 2000) 

2. Fay v. South Colonie Cent. Sch. Dist., 802 F.2d 21 (2d Cir 
1986), Tarka v. Cunningham, 917 F.2d 890 (5th Cir. 1990) 

3. 42 U.S.C. § 1983. 
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e Disclosure to accrediting organi- 
zations to carry out their accrediting 
functions. 

Disclosure of directory information, 
if certain conditions are met. “Dir- 
ectory information” is information in 
education records that would not 
generally be considered harmful or 
an invasion of privacy if disclosed. It 
includes, but is not limited to, the 
student’s name, address, telephone 
number, date of birth, awards, and 
participation in officially recognized 
activities.”’ Directory information 
may be disclosed without consent 
only if parents have been told that 
such disclosure is possible and have 
been given the opportunity to direct 
the school not to disclose any direc- 


tory information about their child. 


If a school official violates FERPA, 
the U.S. Department of Education may 
investigate and then may terminate 
federal financial assistance, but only if 
the secretary of education finds that the 
school has failed to comply and will not 
comply voluntarily. This simply does 
not happen: schools that have not 
complied with the law promise to 
comply in the future. Although cutting 
off federal aid is the sole remedy in 
FERPA itself, in a few cases, parents 
have successfully sued for damages 
The U.S. 


Supreme Court has agreed to review a 


under another federal statute. 


case that presents this issue (see the 
sidebar on page 40). 

FERPA’s fundamental principles are 
clear and can be outlined even in this 
very brief summary. Although these 
principles are well understood and the 
statute and its regulations*! specifically 
address many situations faced by school 
officials, new questions about FERPA’s 
meaning continue to be litigated. In ad- 
dition to the question of whether parents 
may sue for violations of FERPA, the U.S. 
Supreme Court recently decided a case 
involving the definition of “education 


records” (see the sidebar on page 40). 


Conclusion 


This article only skims the surface of 
two student privacy issues: searc hes at 
school and education records. Even 


within these two areas, many issues 
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have not been fully discussed—for 


example, the confidentiality of special 


education records, searches of students’ 
lockers, and use of metal detectors and 
drug-detection dogs. Other privacy 
issues have not been addressed at all, 
among them the confidentiality of 
information told to a school counselor, 
limitations on gathering certain personal 
information, disclosure of information 
to and from the juvenile justice system, 
and the use of students as research 
subjects. *2 

Nonetheless, several conclusions may 
be drawn from this discussion. First, the 
cays when school officials were con- 
sidered as acting in place and on behalf 
of parents are gone, at least within this 
context. Second, students have privacy 
interests that must be respected by 
school officials. Third, these officials 
have substantial guidance from the well- 
developed law of student searches and 
student records. Fourth, important 
questions about searches and records 
remain unresolved, though some of 
them will be answered this year. Finally, 
the law affecting student privacy will 
continue to evolve as school officials 
and students operate in a changing 


school environment. 
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microfilm, and microfiche. 34 C.ER. § 99.3. 

25. 20 U.S.C. § 1232g(a)(4); 34 C.ER. 


93. 


School officials 
may search a 
student’s book 
bag if they 

have reasonable 
suspicion that 
the bag contains 
evidence of 

a violation of 

a law ora 
school rule. 


26. 20 U.S.C. § 1232g(a)(4). Note that 
when FERPA allows a school board to 
disclose information, it does not mandate that 
the board do so. Other statutes and policies 
may require the board to disclose information 
when FERPA allows it. 

27. 34 CFR § 99.31. 

28. John Rubin, Subpoenas and School 
Records: A School Employee’s Guide, 30 
SCHOOL LAW BULLETIN 1 (1999). 

29. 20 U.S.C. § 1232g(a)(4). 

30. Fay v. South Colonie Cent. Sch. Dist., 
802 F.2d 21 (2d Cir. 1986), Tarka v. 
Cunningham, 917 F.2d 890 (Sth Cir. 1990) 
(beth holding that parent or student may 
bring FERPA claim under 42 U.S.C. § 1983, 
which allows lawsuits when claim is that right 
protected by federal statutes has been 
violated). 


34 CER. § 99. 


31. 
32. For information on limitations on 


gathering certain personal information, see 
the Hatch Amendment, codified at 20 U.S.C. 

1232h. For information on disclosure of 
information to and from the juvenile justice 
system, see www.ed.gov/offices/OESE/SDFS/ 
actguid/infshare.html (visited Feb. 7, 2002). 
33. For additional information, readers may 
consult their local school boards, use the 
resources cited in note 1, and research privacy 
issues online. Two useful sites are www.ed. 
gov (the federal Department of Education) 
and www.dpi.state.nc.us (the State Depart- 
ment of Public Instruction and the State 
Board of Education). 
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Health Privacy: The New Federal Framework 


Aimee N. Wall 


atients usually expect that health 

information shared and generated 

when they are receiving medical 
care will be kept confidential by their 
health care provider and, if they have 
insurance, by their health insurance plan. 
A recent Gallup survey found that almost 
78 percent of adults believe it is “very 
important” that their health information 
be kept confidential.' Most providers and 
insurers strive to meet these expectations. 
However, other people and organizations 
often need access to health information 
to carry out their responsibilities. For 
example, public health officials want 
health care providers to report commu- 
nicable diseases, law enforcement officials 
expect emergency care providers to re- 
port gunshot wounds, and social services 
agencies rely on health care providers to 
report ev idence of abuse or neglect. 

For many years, federal, state, and 
local lawmakers have struggled to find 
the appropriate balance between pro- 
tecting the privacy of health information 
and ensuring that health information is 
available when necessary for other 
important purposes. A patchwork of 
federal and state laws, rules, common 
law, and professional ethical obligations 
and guidelines has resulted, providing a 
hazy outline at best for when providers 
and insurers may share health informa- 
tion with other entities. This past year, 
however, the first and only comprehen- 
sive federal rule on health privacy went 
into effect.* This article provides a brief 
history of the new rule, summarizes many 
of the rule’s complex requirements, and 
offers a few suggestions for entities and 
local governments, particularly counties, 


to consider as they begin to comply. 


Why Is the New Rule Necessary? 


Until recently the federal government 


approached the issue of privacy in a 
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piecemeal fashion. Several laws dealt 
with health information privacy but did 
not regulate it comprehensively. For 
example, most information held by the 
federal government that identifies indi 
viduals is subject to the Privacy Act of 
1974;' health information held by sub- 
stance abuse programs receiving federal 
assistance is subject to a substance abuse 
confidentiality rule;* and information 
held by providers treating Medicare and 
Medicaid patients is subject to an array 
of confidentiality statutes and rules. 
Similarly every state has health pri 
vacy laws, but only a handful are 
comprehensive.® The vast majority of 
states, including North Carolina, have 
limited laws governing only particular 
types of entities, such as HMOs,’ or 
specific conditions, such as communi- 


cable diseases.* 
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The result of this piecemeal approach 
has been that under most circumstances, 
people could not be assured that health 
care providers, insurers, or others were 
legally required to keep health informa- 
tion confidential.’ Many argued that the 
legal framework was fractured and wholly 
inadequate to protect information."” 

As health care delivery entered the 
electronic age, concerns about privacy 
increased. The health care industry 
began to integrate technological tools 
into the practice of medicine—for 


example, electronic medical records, 
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“telemedicine” (the use of telecommuni- 
cations to support long-distance clinical 
care), and electronically filed insurance 
claims. The industry appealed to Congress 
for legislation to facilitate electronic 
sharing of information between providers 
and insurers. Congress passed such 
legislation as part of the Health Insur- 
ance Portability and Accountability Act 
of 1996 (HIPAA). One part of this legis- 
lation, entitled Ad- 
ministrative Simplifi- 
cation, directed the 
U.S. Department of 
Health and Human 
Services (DHHS) to 
develop a series of 
rules that would stan- 
dardize the electronic 
sharing of health 
information and dra 
matically reduce ad- 
ministrative expenses. 

Congress recog- 
nized, however, that 
because Administra- 
tive Simplification 
would encourage 
health information 
to flow more freely, 
preserving the confi- 
dentiality of that 
information had to 
become a high priority 
at the federal level. 
Therefore, as part of 
Administrative Sim- 
plification, Congress also directed 
DHHS to develop rules governing both 
the privacy and the security of health 
information. Privacy and security are 
closely connected but distinct concepts. 
Privacy is “the patient’s right over the use 
and disclosure of his or her own personal 
health information,” whereas security is 
the “specific measures a health care 
entity must take to protect personal 
health information from unauthorized 
breaches of privacy.” 

In recognition of this difference, 
DHHS is developing separate rules for 
privacy and security. The security rule 
was proposed in 1998 but has not yet 
been finalized. The privacy rule, which 
is the focus of this article, was finalized 
during the Clinton Administration, and 


the compliance date is currently April 
14, 2003, for most health care providers 


A doctor's laptop was 

stolen at a medical conference. 
The computer contained 

the names and medical 
histories of his patients in 
North Carolina. 


From A. Santana, Thieves Take More 
than Laptops, WASHINGTON Post, 


and insurers.'* In March 2002 the Bush 
Administration proposed several signifi- 
cant revisions to the privacy rule.'* After 
the public has had an opportunity to 
comment on the proposed revisions, 
DHHS will consider whether to adopt 
any changes recommended by the public, 
and then it will publish another final 
privacy rule. DHHS has indicated that 
compliance with the rule is still ex- 
pected by April 2003, 
although Congress 
could delay the 
compliance date. 


What Do Local 
Governments 
Need to Do? 


The privacy rule 
requires “covered 
entities” —public and 
private health plans, 
health care clearing- 
houses, and most 
health care providers 
(those that transmit 
health information 
electronically) —to 
make significant 
administrative and 
organizational 
changes in the way 
that they handle 
health information. 


Nov. 5. 2000, at Al 


Many different 


Jail health programs and social services 
agencies also may be regulated entities. 
Law enforcement officials, courts, and 
medical examiners may not be covered 
entities, but because they often need 
health information from covered enti- 
ties, such as health departments, social 
services agencies, and private health 
care providers, the new restrictions on 
disclosure will affect their ability to 
carry out their duties. 

Given that the compliance date is fast 
approaching, state and local governments 
must immediately begin making some 
changes. In North Carolina, efforts are 
well under way at the state level to 
bring state agencies into compliance 
with the privacy rule. Last October, the 
General Assembly directed the Office 
of State Budget and Management to 
develop a strategic plan for implement- 
ing HIPAA.'* 

By contrast, local governments are 
in many different stages of readiness 
to comply. Some counties have only a 
basic awareness of the new law, whereas 
others have developed a strategic plan, 
hired a privacy officer, and are working 
toward compliance. Local govern- 
ments should be taking a careful look 
at their operations and developing a 
compliance plan. 

If it has not already done so, a 
county should immediately appoint a 
compliance officer, preferably an 


attorney, to become familiar with the 


HeLpruL HIPAA Wes Sites 


U.S. Department of Health and Human Services, Office of Civil Rights 


www.hhs.gov/ocr/hipaa/ 


North Carolina HIPAA Program Management Office 


dirm.state.nc.us/hipaa/ 


UNC-Chapel Hill, Institute of Government and School of Public Health 


Medical Privacy Training 
www. medicalprivacy.unc.edu 


North Carolina Healthcare Information and Communications Alliance, Inc. 


www.nchica.org 


components of local government will 
be affected by this new rule either 
directly or indirectly. For example, local 
health departments, area mental health 
authorities, and emergency medical 
service agencies are directly regulated 
because they are health care providers. 


privacy rule and oversee its implementa- 
tion throughout the county. Once the 
officer understands the rule, he or she 
should determine which components of 
local government are covered entities, 
such as local health departments and 
jail health programs (see the later 
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New INDIVIDUAL RIGHTS 


Arguably the most revolutionary aspect of the HIPAA privacy regulations is the 
establishment of several new individual rights. The basic principle underlying 
these new rights is that people should be able to understand how their health 
information is used and disclosed and have some opportunity to control it. The 
privacy rule establishes several rights intended to ensure that individuals are 
able to control their health information, including the right to a notice of 
privacy practices, the right to inspect and amend health information, the right 
to receive a disclosure history, and the right to request certain restrictions on 
disclosure. Covered entities, including all local health departments and area 
mental health authorities, will need to develop and implement policies and 
procedures to accommodate these new rights. 


Right to Notice 

The key to gaining control over one’s health information is having a clear and 
accurate understanding of how that information is used and shared with 
others. As DHHS explained, “One of the goals of this rule is to create an 
environment of open communication and transparency with respect to the use 
and disclosure of . . . health information.”' Therefore the privacy rule creates 
an individual right to a notice of privacy practices that covered entities must 
develop and disseminate to patients and enrollees. 


This notice is not a simple statement saying, “We will keep your personal 
health information confidential.” Rather, the notice is intended to be a fairly 
comprehensive inventory of how the entity may use and disclose health 
information and an explanation of the individual's rights and the entity's legal 
duties with respect to that information. The rule outlines the types of informa- 
tion that must be included in the notice and requires that it be drafted in “plain 
language.” It is extremely important that these notices be drafted carefully and 
updated regularly because covered entities are bound by their notices. In other 
words, if they use or disclose health information in a way that is not specified 
in their notice, they could be subject to civil or criminal penalties. 


Right of Access and Amendment 

In addition to understanding how health information is used and shared, a 
patient must have access to that information in order to know exactly what 
information is being used and shared. The privacy rule therefore establishes a 
right to inspect and obtain a copy of most health information held by covered 
entities. The rule sets out several circumstances in which a patient's request for 
access may be denied, such as when the information requested is psycho- 
therapy notes or has been compiled for legal or administrative proceedings. 

A request for access also may be denied if a health care professional 
determines that access is “reasonably likely to endanger the life or physical 
safety of the individual or another person.”? If a covered entity denies a 
request, in some situations an individual may request that the decision be 
reviewed. The entity must act on such a request within sixty days, and it may 
charge a reasonable, cost-based fee for a copy of the information. 


Now that patients have the right of access, it is only logical that they also be 
provided with the right to have the covered entity amend information that 
patients find to be inaccurate or incomplete.* The entity may deny an 
amendment request for a variety of reasons. Most important, it may deny a 
request if it determines that the information is in fact accurate or complete. 
if the entity does deny a request, the patient has the right to submit a 
“statement of disagreement,” which must be kept with the record and 


Continued on page 47 
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section headed “Who Is Regulated?”). 
It is possible that the entire county will 
be considered a covered entity. In such 
a case, the county’s compliance officer 
still will need to identify the com- 
ponents of the county that must comply 
with the rule. 

In addition to identifying covered 
entities, the county should identify other 
components of local government that 
use and share health information, and 
evaluate whether and how those com- 
ponents can continue obtaining health 
information from covered entities after 
the compliance date. For example, the 
privacy rule places new restrictions on 
when law enforcement officials may 
obtain health information without a 
court order. The compliance officer 
must evaluate the current practices of 
law enforcement officials and determine 
if any changes need to be made in order 
to ensure that the officials can obtain 
health information when necessary. 

Once a county has identified all the 
local entities that will be directly and 
indirectly affected by the rule, it should 
develop a countywide compliance plan. 
Just as the state has designated a HIPAA 
Program Management Oftice to oversee 
the state’s implementation, counties 
would be prudent to consider central- 
izing compliance activities at the county 
level. In addition, a regional approach 
may be appropriate in the case of area 
mental health authorities or public 
health districts. Although each county 
component will encounter unique 
challenges to implementation, having a 
coordinated and comprehensive county- 
wide plan for ensuring that the April 
2003 deadline is met will be worth- 
while. (For a list of steps that an entity 
should take to move toward compliance 
within the necessary timeframe, see the 
sidebar on page 48. For Web resources, 


see the sidebar on page 45.) 


Who Is Regulated? 


When Congress passed HIPAA, it 


specifically limited the scope of the law 
to three types of entities: health care 
providers, health plans, and health care 
clearinghouses (defined later).'!* Many 
other groups—for example, employers, 
courts, researchers, and marketers— 
regularly handle personal health 
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disclosed with the record any time that the entity shares the disputed 
information with another entity. 


If the entity accepts a request for an amendment, it need not alter the actual 
record but must identify the affected information and either append the amend- 
ment or provide a link in some way to the amendment. After accepting the 
amendment, the entity is required to make reasonable efforts to notify certain 
other entities that received the inaccurate or incomplete information. The entity 
must act on an individual's request for amendment within ninety days. 


Right to an Accounting of Disclosures 

To keep track of where his or her health information is going, a patient now 
is able to request a disclosure history from a covered entity—basically an 
accounting of each time that the entity has disclosed identifiable health 
information to other entities in the previous six years.> The history will provide 
the patient with important information about disclosures made without his 
or her permission, such as certain disclosures to researchers or government 
officials. 


The history does not have to include any of the standard disclosures that an 
entity makes for purposes of treatment, payment, or health care operations 
(business practices like quality assurance that require the use of health 
information)—most likely the vast majority of disclosures. The history also may 
exclude certain other types of disclosures, such as those from a hospital's 
patient-information line 


Right to Request Additional Protections 

The privacy rule also provides individuals with two new tools to help them gain 
control over how their information is disclosed.® First, they have the right to 
request that health care providers and health plans make special arrangements 
for communicating directly with them. For example, a patient may request that 
her provider or health plan send all communications (bills, test results, and so 
forth) to a work address rather than a home address. The provider must 
accommodate such a request. The health plan, meanwhile, must accommodate 
such a request only if the patient “clearly states that the disclosure of all or part 
of [the] information could endanger the individual.” 


Second, patients have the right to request certain restrictions on the use or the 
disclosure of their health information. For example, a patient may request that 
a provider not disclose his information for research purposes. This second right 
is not particularly strong because it is only the right to request—the entity is not 
required to accept the request. However, if the entity does accept the request, 
it is bound by the request (except in emergency circumstances), so a disclosure 
in violation of the request would be considered a violation of the privacy rule. 


Notes 

1. Standards for Privacy of Individually identifiable Health Information; Final Rule, 65 Fed. 
Reg. 82,462, 82,549, 82,820 (Dec. 28, 2000). 

2. 45 C.FR. § 164.520. 

3. 45 C.ER. § 164.524. Before the privacy rule, about half of the states, including North 
Carolina, provided some statutory rights of access. See, e.g., N.C. GEN. STAT. § 58-39-45 
(hereinafter G.S.) (requiring certain insurance institutions to provide individuals with access 
to certain information); G.S. 122C-53(c) (requiring facilities providing treatment to people 
who are mentally ill, developmentally disabled, or substance abusers to provide access under 
certain circumstances) 

4. 45 C.FR. § 164.526. 

5. 45 C.FR. § 164.528. 

6. 45 C.FR. § 164.522 


information, but they are not covered 
by the privacy rule because DHHS does 
not have the legal authority to include 
them. If an entity is covered, it must 
comply with the privacy rule and will 
be subject to significant criminal and 
civil monetary penalties for violations." 

he privacy rule broadly defines 
“health care provider” to include any 
“person or organization who furnishes, 
bills, or is paid for health care in the 
normal course of business.”'” The rule 
applies only to providers that transmit 
health information electronically in 
connection with one of several types of 
health care transactions (for example, 
health insurance claims). Once a 
provider conducts such a transaction, 
all the individually identifiable health 
information held by that provider is 
covered by the rule. Almost all pro 
viders, including all local health 
departments and area mental health 
authorities, conduct some form of 
electronic transaction, either through 
their own business office or through a 
contract with a third-party billing 
company. As a result, only a handful of 
providers are likely to be exempt from 
the privacy rule. For example, a small 
jail health program or private free clinic 
might not submit any insurance claims 
electronically and therefore would not 
be covered. 

By contrast, all health plans and 
health care clearinghouses are required 
to comply. “Health plan” is defined to 
include not only traditional private 
health insurance plans like Aetna and 
Blue Cross/Blue Shield but also public 
insurance programs, including 
Medicare, Medicaid, and the State 
Children’s Health Insurance Program 
(known as Health Choice in North 
Carolina).'* If a county self-insures to 
provide employee health insurance, it 
will most likely be covered by the 
privacy rule as a health plan. A “health 
care clearinghouse” is, in general, an 
entity (public or private) that translates 
health information from one data format 
to another.'” It is unlikely that a county 
operates a health care clearinghouse, 
although it may contract with one. 

Even though the privacy rule tech- 
nically covers only these three types of 
entities, DHHS indirectly extended the 


reach of the rule to some noncovered 
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entities by requiring covered entities to 
have contracts with their business 
issociates. A “business associate” is a 
third party that uses identifiable health 
information to provide services to or for 
the covered entity or otherwise assist the 
entity with its activities—for example, a 
billing company, an accountant, an 
uttorney, or a consultant.’ The rationale 
for expanding the scope of the rule is 
that if it were restricted to the three 
types of entities, individuals could not 
be assured that their health information 
would be protected. In other words, 
once the information traveled from a 
covered entity to a noncovered one, the 
privacy rule would become meaningless 
because it could no longer protect the 
information, and in many instances, no 
other law would be available to protect 
the information.?! For example, if a 
health department contracted with a 
vendor to file insurance claims and 

bill individuals for health services, the 
vendor would most likely not be a 
covered entity, and theoretically it could 
choose to use, disclose, or even sell a 

list of patients treated by the health 
department.”* Under the privacy rule, 
the health department must enter into a 
contract with the vendor that requires 
protection of the information. 

Che biggest problem with this con 
tractual requirement is that only the 
covered entity, not the business asso 
ciate, is subject to DHHS enforcement. 
Therefore, DHHS can hold only the 
covered entity responsible if the busi 
ness associate breaches the contract and 
discloses health information inappro- 
priately.*’ In response to public com 
ments, DHHS stated that the regulatory 
authority provided by the underlying 
statute, HIPAA, was too limited and 
admitted that such indirect regulation of 
business associates was not the ideal 
approach but was necessary to ensure 
that the information was protected. 
DHHS has therefore encouraged 
Congress to pass new legislation that 
would allow these entities to be 


regulated directly.?* 


What Information Is Regulated? 


lhe rule applies to health information 
that identifies individuals, in any form 
or medium, including electronic, paper, 
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WHAT SHOULD A Covered Entity Do Now? 


To comply with the new privacy rule by April 2003, covered entities should be 
taking action now. Suggested steps follow. 


Designate a privacy officer. He or she should understand all the 
requirements of the privacy rule, as well as any other applicable federal and 
State privacy laws. The officer should be responsible for overseeing 
implementation of the privacy rule within the entity, providing training or 
organizing training for other members of the entity's workforce, and 
monitoring compliance. 


Conduct a “gap analysis.” Review current information-sharing practices in 
order to compile a comprehensive inventory of how health information is used 
within the entity and disclosed to outside people or entities. Identify business 
associates—that is, third parties that use identifiable health information in 
providing services to a covered entity. Focus on situations or relationships in 
which information is currently used or disclosed in a way that violates the 
privacy rule. 


Develop a compliance plan. This plan should begin with the gap analysis, 
include all the steps necessary to come into compliance, and end with an 
ongoing plan for monitoring compliance. Entities should work with 
experienced attorneys or compliance officers in developing and implementing 
the plan. 


Develop and maintain privacy policies and procedures. Each entity's 
policies and procedures must be comprehensive, and they must be reviewed 
regularly to ensure that they reflect the entity's current practices as well as 
changes in state or federal law. Entities must maintain a written or electronic 
copy of their policies and procedures. 


Review current forms and notices. Review current consent and 
authorization forms (for example, release of information, or ROI, forms) and 
any notices that are provided to patients. Consult with an attorney to prepare 
new forms and a notice of privacy practices that are consistent with the privacy 
rule. As with the entity's policies and procedures, these forms and notices must 
be kept up-to-date and accurate. 


Develop training. The rule requires each entity to train its workforce on its 
policies and procedures before the compliance date (April 2003); to train new 
employees within a reasonable period after they join the workforce; and 
periodically to retrain any employee affected by a material change in law, 
policy, or procedure. The training should not only outline the requirements of 
the rule but also reflect all applicable federal and state laws and the agency's 
own policies and procedures. 


Consider developing a coalition. Hundreds of entities throughout the state 
will be working at the same time on compliance. Although each entity will 
have to address particular needs and practices, creating a coalition of similar 
entities (such as local health departments in a region) that can work together 
toward compliance may be worthwhile. For example, the coalition might serve 
as an advisory group, develop a core set of policies and procedures, prepare 
draft forms and notices, and offer common training to the workforces of 
coalition members. 





and even oral information. Critics of the 
rule argued that it is far too expansive 
and that Congress intended DHHS to 
regulate only electronically transmitted 
information. In reponse, DHHS asserted 
that Congress authorized the regulation 
of all health information and that this 
approach was the most reasonable and 
practical means available. Specifically, 
DHHS explained that limiting the 
application of the rule to electronically 
transmitted informa- 

tion would have 

created an “artificial 

boundary” because 

information Is 

constantly moving 

from one format to 

another.*’ For ex- 
ample, a health care 
provider may submit 
a claim to Medicaid 
electronically, print 
out a copy of the 
claim, and discuss it 
with a co-worker. In 
this example, only the 
format of the infor- 
mation, not the 
content, has changed. 
lhe privacy rule 
would not adequately 
protect the content 
of the information if 
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the rule was limited 
to electronically 
transmitted infor- 
mation. 


What Does the Rule Require? 


Che requirements outlined in the 
privacy rule are based on many of the 
practices that already are employed by 
health care providers and insurers 
across the country. The rule compiles 
many of these practices into a single, 
comprehensive law. Although numerous 
terms and concepts, such as “patient 
consent” and “patient authorization,” 
will be familiar throughout the health 
care industry, the privacy rule redefines 
many terms and concepts and inserts 
them into a new framework. 

The privacy rule has four basic parts: 


1. Use and disclosure: An entity may use 
or disclose identifiable health information 


A banker who also served on 
his county's health board cross- 
referenced customer accounts 
with patient information. He 
called due the mortgages of 


anyone suffering from cancer. 
From M. Lavelle, Health Plan 
Debate Turning to Privacy: Some Call privacy policies and 


for Safeguards on Medical Disclosure. Is 


, May 30, 1994, at Al 


only when the rule either requires or 


allows the use or the disclosure. 


2. Minimum necessary: When an entity 
uses or discloses health information (as 
required or allowed by the rule), it must 
“make reasonable efforts to limit the . . . 
information to the minimum necessary 
to accomplish the intended purpose of 


the use or disclosure. .. .”? 


3. Individual rights: 
An entity must re- 
spond to and accom- 
modate some new in- 
dividual rights (see the 
sidebar on page 46). 


4, Administrative 
requirements: An 
entity must institute 
certain business 
practices, such 

as documenting 
privacy policies and 
procedures, desig- 
nating a privacy 
officer, providing 
training for em- 
ployees, and estab- 
lishing a system of 
sanctions for em- 
ployees who violate 
procedures.”® 
Necessary? NATIONAL : 

The first part of 
the framework, which 
outlines the required 
and allowed uses and disclosures, is 
perhaps the most complicated part of 
the rule, so it is discussed here in detail. 
he rule requires disclosure in only two 
instances: first, when DHHS needs 
information to evaluate an entity’s 
compliance with the rule, and second, 
when a patient requests a copy of his or 
her own information (for a discussion 
of the patient’s right to request access to 
his or her health information, see the 
sidebar on page 46). The rule allows use 
and disclosure in several instances, 
which fall into three general categories: 
(1) use or disclosure for purposes of 
treatment, payment, and health care 
operations, (2) use or disclosure with 
the patient’s permission, and (3) use or 
disclosure without the patient’s 
permission. 


Use or Disclosure for Treatment, 
Payment, and Health Care Operations 


The original version of the privacy rule 
published by the Clinton Administra- 
tion requires most health care providers 
to obtain the patient’s express permis- 
sion to use health information for 
treatment, payment, and health care 
operations.’ This type of patient 
permission is termed “consent” under 
the rule.*° For example, a local health 
department’s prenatal clinic would be 
required to seek a woman’s consent 
before providing her with prenatal care 
or billing her insurer for that care. The 
consent also would allow the health 
department to use the woman’s health 
information for its “health care opera- 
tions”—a term that is defined broadly 
to include many of the business prac- 
tices that require the use of health 
information, such as quality assurance, 
credentialing of providers, and other 
management activities. 

rhis consent requirement may 
ultimately be eliminated from the final 
privacy rule. In the suggested revisions 
published this March, the Bush Admin 
istration proposed changes that would 
allow all covered entities, including 
health care providers, to use and dis- 
close health information for treatment, 
payment, and health care operations 
without obtaining the patient’s consent. 
In proposing the change, DHHS ex- 
plained that the consent process in the 
current version of the privacy rule could 
“potentially interfere with the efficient 
delivery of health care.”*! In lieu of the 
consent requirement, DHHS proposes 
to require covered entities to attempt to 
obtain a patient’s written acknowledg- 
ment that he or she received a copy of 
the entity’s notice of privacy practices 
(fora description of the requirement 
for a notice of privacy practices, see 
the sidebar on page 46). For example, 
under the Bush Administration’s 
proposal, the health department’s 
prenatal clinic would not be required 
to obtain the woman’s consent to use 
her information for treatment or billing 
purposes, but it would need to give 
her a copy of the department’s notice 
of privacy practices and attempt to 
have her acknowledge receiving the 
notice by signing a form or a log. 
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Therefore, regardless of whether the 
final rule requires a consent or simply 
an acknowledgment of the notice, 
covered entities will need to have sys 
tems in place for obtaining signatures 
whenever necessary and maintaining 


appropriate documentation. 


Use or Disclosure with the 
Patient's Permission 

In addition to consent, the privacy rule 
recognizes three other types of patient 
permission: authorization, opportunity 
to opt out, and opportunity to agree or 
object. Each type applies in different 
circumstances and comes with its own 
set of requirements. 

Patient authorization is required when 
an entity wants to use or disclose health 
information in a way that is not other- 
wise permitted by the privacy rule. A 
patient may authorize any type of use or 
disclosure as long as the authorization 
form is consistent with the detailed format 
and content requirements contained in 
the rule. For example, if a school requires 
students to have physical examinations 
before participating in school sports, a 
provider (such as a local health depart- 
ment) would have to obtain an authoriza- 
tion (most likely from the parent or guar- 
dian) before sending a copy of the physical 
examination results to the school. 

lhe last two types of individual 
permission apply in 
narrow circum 
stances and are 
more informal than 
authorization. First, 
a person must be 
given an opportunity 
to opt out of certain 
uses or disclosures, 
such as the entity’s 
use of health infor- 
mation for fund- 
raising purposes. For 
example, if a hospital 
wants to use a list of 
all its cardiology 
patients in a mailing 
to raise money for an 
expansion of the 
cardiac care unit, it 
must include a state- 
ment in its materials newspapers. 
explaining how a 
patient may opt out 
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In Tampa, a public health 
worker walked away with 
a computer disk containing 
the names of 4,000 people 
who tested positive for HIV. 
The disks were sent to two 


From J. Bacon, AIDS Confidentiality, 
USA Topay, Oct. 10, 1996, at Al 


of receiving such fund-raising communi- 
cations.*? Second, a person must have 
an opportunity to agree or object when 
an entity is going to use health informa- 
tion in a facility directory (for example, 
if a hospital discloses information about 
a patient’s condition to the general public 
through a patient-information line), dis- 
close information to someone involved 
in the person’s care (for example, a 
friend or a family member), or disclose 
information to people or organizations 
involved in certain disaster relief 
efforts.*> The entity may orally inform 
the person that he or she has the right to 
object, and the person may orally agree 
or object to the use or the disclosure. 


Use or Disclosure without the 
Patient's Permission 

One aspect of the privacy rule that 
surprises many members of the public 
is that it allows entities to disclose 
health information in a wide variety of 
circumstances without the patient’s 
permission. In drafting the rule, DHHS 
recognized that “health information is 
needed to support certain national 
priority activities” and that “|i]n many 
cases, the need to obtain authorization 
for use of health information would 
create significant obstacles in efforts to 
fight crime, understand disease, and 
protect public health.” * These national 
priority activities relate to the following: 


e Public health 


Victims of abuse, 
neglect, or domestic 
violence 

Law enforcement 
Judicial and adminis- 
trative proceedings 
Health oversight 
(for example, fraud 
and abuse investi- 
gations, civil rights 
investigations, and 
licensure or disci- 
plinary activities) 
Correctional insti- 
tutions 

Workers’ compen- 
sation 

Duties of a coroner 
or a medical ex- 
aminer 


e Organ, eye, or tissue donation 


e Research 


Many of these activities are the 
responsibility, in whole or in part, of 
state and local governments. Although 
the privacy rule allows entities to share 
health information with state or local 
officials for many of these activities, 
each type of disclosure may have new 
strings attached.** For example, if a 
health care provider has reasonable 
cause to believe that an adult with 
disabilities needs protective services, 
the provider is currently required by 
state law to report this information to 
the county director of social services. ** 
The privacy rule allows this reporting 
but also requires the provider to notify 
the adult that the report has been or 


will be made (subject to limited excep- 


tions). 

In addition to these listed categories 
of permissible disclosures, the rule pro- 
vides broad authority for disclosures 
that are “necessary to prevent or lessen 
a serious and imminent threat to the 
health or safety of a person or the 
public.” ** These disclosures must be 
consistent with applicable law and 
ethical standards, be made in good 
faith, and be made to a person 
reasonably able to prevent Or lessen the 
threat. A mental health provider, for 
example, might rely on this authority to 
disclose health information about a 
dangerous patient to law enforcement 


authorities or a potential victim. 


How Does the Rule Affect 
Current Laws? 


North Carolina has more than one 
hundred state statutory provisions, plus 
many more rules, court decisions, and 
policies, that intersect with the privacy 
rule in some way. Many covered entities 
argued that expecting them to comply 
with a comprehensive federal law in 
addition to all the state laws was un- 
reasonable; therefore the federal privacy 
rule should preempt (or override) all 
other privacy laws. Despite this argument, 
Congress did not provide DHHS with 
the authority to preempt all other privacy 
laws.*’ Rather, it established an extra- 
ordinarily complicated relationship be- 
tween the privacy rule and other laws. 





The privacy rule promulgated under HIPAA provides 
more comprehensive safeguards than previous federal 
and state legislation did for patients’ private 
information, such as records of counseling and therapy. 


People often say as a rule of thumb 


that HIPAA establishes a “federal floor” 


of privacy protections. In other words, 
all federal, state, and local privacy laws 
that are “more stringent” (more 
protective) than the privacy rule will 
remain in place.*® This rule of thumb 

is accurate to some extent, but many 
state laws will remain in place whether 
or not they are more stringent than the 
privacy rule. 

First, the privacy rule “carves out” 
several categories of laws from 
preemption—for example, laws that 
provide for the reporting of disease or 
injury, child abuse, birth, or death. 
North Carolina has many laws that 
fall into one or more of these carve- 


outs. For example, one statute directs 


hospitals to keep birth and death 


records and to make those records 
available to the state registrar.*! This 
statutory provision falls within the 
carve-out and therefore is not affected 
by the privacy rule. 

Second, the secretary of DHHS may 
make individualized determinations 
that a particular law is not preempted 
because it is necessary for certain 
stated purposes, such as preventing 
fraud and abuse.’ 


Third, the most confusing exception 
to the federal-floor rule of thumb is 
that the privacy rule specifically leaves 
in place any law that “requires” a 
disclosure. A disclosure is “required 
by law” if it is mandated by a statute, 
regulation, court-ordered warrant, 
grand jury subpoena, civil investigative 
demand, or similar authority.** For 
example, a North Carolina statute 
requires substance abuse facilities to 
furnish health information to the 
commissioner of motor vehicles 
regarding people who are involuntarily 
committed for the treatment of 
alcoholism or drug addiction.** This 
law will likely stay in effect because 
the disclosure is required by law, 
even though the general philosophy 
underlying the privacy rule would 
require the patient’s authorization for 
such a disclosure. 

Given this complex relationship 
between state and federal law, it is 
crucial that covered entities and others 
who need health information to do their 
work (such as law enforcement officials 
and health oversight agencies) seek 
sound legal advice as they work toward 
an understanding of their rights and 
obligations. 


Conclusion 


The requirements of the privacy rule 
add a new layer to the already complex 
landscape of health privacy law. The 
process of understanding the new law 
and coming into compliance with it will 
most certainly be resource-intensive and 
time-consuming. Therefore, if they have 
not already done so, local governments 
and covered entities should begin this 
process as soon as possible. Once the 
necessary changes have been imple- 
mented and staff have been appropriately 
trained, all the new requirements that are 
perhaps intimidating at first glance will 


become second nature. 
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Privacy and Computer Security: Nine Questions 


Kevin FitzGerald 


his issue of Popular Government 

has devoted much attention to 

the legal parameters on sharing 
and protecting private information. Of 
equal importance is the security of 
information technology systems that 
store and convey sensitive information. 
This article poses nine straightforward 
questions for government officials to 
consider in assessing the security of 
their systems. 

There is little doubt that informa- 
tion technology provides critical sup- 
port for the delivery of government 
services. Although direct expenditures 
for technology often represent less than 
2 percent of a local government’s bud- 
get, the reach of technology extends to 
practically every government service. It 
is hard to imagine delivering services 
without the assistance of computer 
technology. 

Local governments, large and small, 
support a vast array of computer hard- 
ware and software systems. They ex- 
change public and private information 
via the Internet and a variety of “secure” 
networks among fellow employees, 
citizens, clients, and other governments. 
All expect information systems to do 
the work they were designed to do, be 
available when they are needed, and 
maintain the reliability and the integrity 
of the information that is contained 
within them. 

The importance of security is 
heightened, and security is made more 
difficult, as an increasing number of 
people connect to public information 
systems. More and more, citizens and 


employees expect Web-based access to 
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GLOSSARY 


Disaster recovery plan: [A] plan 
maintained for emergency response, 
backup operations, and post- 
disaster recovery for an information 
system (IS), to ensure the availability 
of critical resources and to facilitate 
the continuity of operations in an 
emergency situation 


Firewall: [A] system designed to 
defend against unauthorized access 
to or from a private network. 
Firewalls can be implemented in 
both hardware and software, or a 
combination of both. 


Patch: In a computer program, one 
or more statements inserted to cir- 
cumvent a problem or to alter tem- 
porarily or permanently a usually 
limited aspect or characteristic of the 
functioning of the program, e.g., to 
customize the program for a par- 
ticular application or environment. 


Virus: 1. An unwanted program 
which places itself into other pro- 
grams, which are shared among 
computer systems, and replicates 
itself. Note: A virus is usually mani- 
fested by a destructive or disruptive 
effect on the executable program 
that it affects. 2. Self-replicating, 
malicious program segment that 
attaches itself to an application 
program or other executable system 
component and leaves no obvious 
signs of its presence. 


Source: Telecom Glossary 2000, maintained 
by the U.S. National Telecommunications 
and Information Administration, available at 
http:/Awww. its. bidrdoc.gov/projects/ 
tiglossary2000/ 
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numerous public services twenty- 
four hours a day. Also, the technology 
supporting these connections is diver- 
sifying as many governments invest in 
applications that rely on high-speed 
Internet connections and support a 
wide variety of wired, optical, and 
wireless equipment. 

These developments require a 
security strategy that keeps pace with 
change while maintaining the funda- 
mental requirements of data integrity. 
And make no mistake: there are daily 
threats to data integrity. The viruses 
(see the glossary, this page) that 
recently spread from Europe to every 
corner of the world, destroying billions 
of dollars’ worth of information and 
erasing countless files, are a spectacu- 
lar example of the damage that hackers 
can cause. The 2001 FBI Computer 
Crime and Security Survey conducted 
by the Computer Security Institute 
ranked computer viruses, improper use 
of Internet connections, the theft of 
laptop computers, and unauthorized 
employee access tO Computer systems 
as the top four types of security at 
tacks, with the cost per incident 
ranging from a few thousand dollars 
to fifty million. 

Clearly this is an issue that local 
officials cannot avoid. Here are nine 
questions to guide local governments 
in assessing their security vulnerabilities 
and in taking reasonable steps to 
mitigate unnecessary risk. (For helpful 
Web sites on computer security, see 


the sidebar on this page.) 


Who in our organization is accountable for 
the security of information technology? 

An organization should designate some- 
one to be responsible and accountable 
for computer security. This often is a 
responsibility of the information tech- 
nology director. The person should have 
sufficient technical training to do the 


job. 


Do we have an information technology 
security plan? 

There should be a written plan that 

is periodically reviewed and well com- 
municated to management and em- 


ploy ees. It should cover critical data 


policies, backup, disaster recovery, and 


user policies. 


HELPFUL LINKS 


Institute of Government, 
Center for Public Technology 
http://www.cpt.unc.edu 

The Center for Public Technology 
is a unit of the Institute of Govern- 
ment. Its mission is to assist North 
Carolina governments in making 
use of information technology 

to improve services and strengthen 
communities 


Top 20 internet Security 
Vulnerabilities 
http://www.sans.org/top20.htm 
This site contains a listing of and 
information on twenty of the 
greatest Internet security vulner- 
abilities. It is maintained by the 
SANS (System Administration, 
Networking, and Security) Institute 
and the National Infrastructure 
Protection Center 


State of North Carolina Security 
Documentation 
http://www..its.state.nc.us/ 
Support/Security/Security.asp 
This site contains information 

on the State of North Carolina's 
security plan. It is maintained 

by the North Carolina Office of 
Information Technology Services. 


Glossary 
http://www..its.bldrdoc.gov/ 
projects/t1glossary2000/ 

The U.S. National Telecommunica- 
tions anc Information Adminis- 
tration maintains this searchable 
glossary. 
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Are our software licenses, patches (see the 
glossary), and various maintenance 
agreements up-to-date? 

Software, equipment, and networks 
are continually modified. It is essential 
that these systems be kept up to-date. 
Making sure that security provisions 
like firewalls (see the glossary) and 
virus software are current is especially 
important. A log of updates should be 


maintained. At times, virus definition 


files are updated several times a day. 
Servers and workstations should be set 
to download updates automatically 
and install the most current versions. 


Is our security plan keeping up with our 
changing use of technology? 

If there has been a recent upgrade in 
systems that changes traditional net- 
work configurations, the assumptions 
of the security plan must be reexamined 
to ensure that the plan has not been 


compre ymised. 


Do we keep valuable equipment 

locked up? 

Theft of equipment, especially laptop 
computers, can easily compromise 
sensitive information. Users whose 
laptops contain sensitive data should 
consider encrypting their hard drives to 


reduce the possibility of misuse. 


How do we know if a hacker has gotten into 
our system or if data have been changed? 
Software is available that is capable of 
detecting whether an unauthorized 


eeveseseereseere 


a a 


Peer r ee 


user has crossed the security perimeter. 
This information is helpful in under- 
standing which systems are particularly 
vulnerable. 


Do we have a disaster recovery plan 

(see the glossary) that is tested and 
capable of supporting operations without 
excessive loss of data? 

Suppose a natural disaster destroys 

a unit’s data center. Is the unit 
capable of restarting operations 

in a reasonable timeframe? Are 
backup tapes stored far enough off 
the site that they would survive a 
disaster such as a tornado? A govern- 
ment unit should consider negotiating 
a reciprocal agreement with another 
unit using the same hardware and 
software, whereby each would 
provide the other with emergency 


processing services. 


What steps have we taken to train 
employees about security? Do employees 
know what is and is not acceptable 
behavior? Do they know where and how to 
report problems? 

Clear written policy related to com- 
puter use and abuse is essential. This 
should be included in an employee’s 


orientation. 


Are we clear in our communications with 
citizens and clients about the security and 
the privacy of the information that is 
maintained? 

Citizen confidence is critical. Citizens 
need to know what steps are being 
taken to ensure that private informa- 
tion is kept private. 


Conclusion 


Identifying what information is private 
is important. Ensuring that private 
information remains secure is just as 
important. Otherwise, privacy, and the 
confidence that citizens place in the 
custodians of the private information, 
may be compromised. 


Note 


1. 2001 CSI/FBI COMPUTER CRIME AND 
SECURITY SURVEY (San Francisco, Cal.: 
Computer Security Inst., 2001), available at 
www.gocsi.com. 
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Law Firm Makes Lead Gift to 
Judicial Endowment Fund 


he law firm of Womble Carlyle 

Sandridge & Rice, PLLC, re- 

cently announced a lead gift of 
$50,000 over five years to the Institute 
of Government Foundation for an 
endowment to enhance continuing 
education programs for North Carolina 
court officials. 

The foundation’s Campaign for 

Judicial Excellence seeks to raise at least 
$500,000 to support special-topic 


seminars On current issues of importance 


in the courtroom; an annual Judicial 
Sentencing Seminar; national speakers 
for annual conferences; new reference 
materials in audio, video, and CD-ROM 
formats; and professional development 
for faculty members in the Institute of 
Government’s courts program. To date, 
more than $100,000 has been raised. 

The Institute of Government’s courts 
program, conducted in partnership 
with the North Carolina Administrative 
Office of the Courts, currently offers 
twenty-one professional conferences 
and seminars (many of which are held 
several times each year) and numerous 
professional publications, which serve 
more than 3,800 judges, magistrates, 
clerks of court, district attorneys, public 
defenders, and others throughout the 
state. 

Established in 1876, Womble 
Carlyle is one of the largest law firms 
in the mid-Atlantic and southeast 
regions, with more than 450 lawyers 
in nine locations, including Charlotte, 
Greensboro, Raleigh, Research Triangle 
Park, and Winston-Salem, North 
Carolina; Atlanta; Greenville, South 
Carolina; McLean, Virginia; and 
Washington, D.C. The firm provides 
legal and technology-based services to 
regional, national, and international 
corporations, businesses, agencies, 
and foundations in a wide range of 
industries, including manufacturing, 
transportation, telecommunications, 
energy, financial services, health care, 
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life sciences, government, education, 
and technology. 

To support this fund for judicial edu- 
cation and the North Carolina courts, 
send your gift to Institute of Government 
Foundation—Drennan Judicial Fund, 
c/o Ann C. Simpson, CB# 3330 Knapp 
Building, Chapel Hill, NC 27599-3330. 


Brown-Graham Joins 
Z. Smith Reynolds Board 


ssociate Professor Anita Brown- 

Graham has joined the thirteen- 

member Board of Trustees of the 
Z. Smith Reynolds Foundation, located 
in Winston-Salem. Brown-Graham is 
Albert and Gladys Hall Coates Term 
Associate Professor of Public Law and 
Government. She specializes in civil 
liability of public officials and local 
governments, and housing and commu- 
nity development. 

Established more than sixty years 
ago for the benefit of the people of 
North Carolina, the foundation now 
has assets of about $520 million. No 
other American general-purpose foun- 
dation of that size has a mandate to 
make grants within a single state. 

In working to enhance the quality of 
life in North Carolina, the foundation 
places a high value on developing new 
programs. It currently gives special 
attention to community economic 
development, the environment, pre- 
collegiate education, and issues affecting 


minorities and women. 


Brown Joins Faculty 


aureen Brown will join the 

School of Government in 

June as associate professor 
of public administration and gov- 
ernment. She will work primarily 
with public administration students 
and local government officials on 
information technology management 
issues. 

Brown comes to the school from 
The University of North Carolina at 
Charlotte, where she taught informa- 
tion systems in public administration, 
research methods, strategic planning, 
policy analysis, and program evalua- 
tion. She is particularly interested in 
the use of information-based tech- 
nologies to promote public and non- 
profit initiatives in service delivery. For 
example, she has worked extensively 
with the Charlotte-Mecklenburg Police 
Department on projects to design and 
manage major technology systems. 

As a senior research fellow at 
George Washington University’s Center 
for Excellence in Municipal Manage- 
ment (Washington, D.C.), Brown also 
teaches executive-level programs on 
information systems for municipal 
leaders and is directing the design and 
development of an electronic govern- 
ment program for state and local 
government executives. 

Brown received a D.P.A. in 1994 
from the University of Georgia. Earlier 
she earned a B.S. at the University of 
Maryland and an M.P.A. at the Uni- 
versity of Oklahoma. 

—Ann C. Simpson 





A Legal Guide to Public 
Employee Free Speech 
in North Carolina 
Stephen Allred 


Third edition, 2002 ¢ $15.00 


North Carolina Legislation 
2001: A Summary of 
Legislation in the 2001 
General Assembly of 
Interest to North Carolina 
Public Officials 

Edited by William A. Campbell 
2002 © $40.00* 


The Precinct Manual 2002 
Robert P. Joyce 
2002 © $8.00 


Recent Publications 





Examines the legal principles governing the 
First Amendment right of public employees to 
speak on matters of public concern and the 
right of public employers to maintain an in North Carolina 
efficient workplace. Written to be helpful to 


lawyers and nonlawyers alike. 


/ die 
grew 
NéHA Geroiine 


Legislation 


A comprehensive summary of the General 


re 


Assembly’s enactments during the 2001 legislative 
session, written by Institute faculty members who 


are experts in the fields affected by the new statutes. 
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The 
Precinct 
Manual 
2002 

Published every two years, this book is a 

basic introduction to the law governing 

administration of elections. Used by precinct 

registrars and judges, it explains North 

Carolina law on registering voters, conducting 

elections, counting ballots, and other matters 


of concern to precinct officials. 
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Introduction to Zoning 
David W. 
Second edition, 


Owens 


Community Standards 
David N. 


Ammons 
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2001 © $20.00* 


Municipal Benchmarks: Assessing 
Local Performance and Establishing 


Second edition, 2001 ¢ $59.95* 


Published by Sage Publications, Inc. 


Suggested Rules of Procedure for the 
Board of County Commissioners 


Third edition, 2002 ¢ $13.00* 


Subscribe to Popular Government and receive the 
next four issues for $20.00* 


Write to the Publications Sales Office, Institute of Government, 
CB# 3330, UNC-CH, Chapel Hill, NC 27599-3330 


Telephone (919) 966-4119 

Fax (919) 962-2707 

E-mail sales@iogmail.iog.unc.edu 

Web site shopping cart https://iogpubs.iog.unc.edu/ 


Free catalogs are available on request. Selected articles are available 
on-line at the Institute's Web site. 


To receive an automatic e-mail announcement when new titles 

are published, join the New Publications Bulletin Board Listserv 

by visiting https://iogpubs.iog.unc.edu/ and scrolling to the bottom 
of the page, or view all School of Government listservs at http:// 
www.iog.unc.edu/listservs.htm. 


*N.C. residents add 6.5% sales tax. 
Prices include shipping and handling. 
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PROQUEST INFORMATION & LEARNIN 
PERIODICALS ACQISITIONS 

PO BOX 1346 

ANN ARBOR, Mi 48106 


THE INSTITUTE OF GOVERNMENT FOUNDATION, INC. 


For a limited time, buy a brick, honor a faculty member, put your name on 

a room, make a gift of any amount—and double its value to the Institute. 
Until summer 2003, a generous challenge grant will match 

individual, corporate, association, and foundation gifts and pledges 

dollar-for-dollar, up to a total of $1 million! These funds will help 

purchase new furnishings and special equipment 

for the renovated and expanded Knapp Building, 

and cover landscaping and other construction 


needs not supported by state appropriations. 


Send your contribution or pledge to Institute of Government Foundation—Building Fund, UNC-Chapel 
Hill, CB# 3330 Knapp Bldg., Chapel Hill, NC 27599-3330. For more information and to contribute on-line, 
visit www.iog.unc.edu. 

For information on naming opportunities and engraved bricks, contact Ann C. Simpson, telephone (919) 
966-9780, fax (919) 962-8800, or e-mail simpson@iogmail.iog.unc.edu. 














